Description
Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://huntr.dev/bounties/000931cc-6d0e-4a4f-b4d8-4ba46ba0e699
Patch, Third Party Advisory x_refsource_misc
https://github.com/jgraph/drawio/commit/01ccb271d34258872b859c0fc1d253cc81341917
Scores
CVSS v3
7.5
EPSS
0.0215
EPSS Percentile
79.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-22
Status
published
Products (1)
diagrams/drawio
< 18.0.5
Published
May 16, 2022
Tracked Since
Feb 18, 2026