CVE-2026-114606 draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114606?
CVE-2026-114606 is a medium-severity vulnerability in jgraph drawio-desktop, published on 22 Oct 2026.
Official description
draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.
Which versions are affected by CVE-2026-114606?
How do I fix CVE-2026-114606?
No fix has been published for CVE-2026-114606 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114606 being exploited?
There is no known exploitation of CVE-2026-114606 in the wild and no public exploit code.
Sources
Also known as GHSA-fjgc-8xgj-rvh4.