Server-Side Request Forgery

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. Drawio <18.0.4 - Server-Side Request ForgeryCVE-2022-1713jgraph · CVSS 7.5 · 9.6% likely

   CWE-918

2. draw.io < 18.0.5 - Server Side Request Forgery (SSRF)CVE-2022-1711jgraph · CVSS 7.5 · 5.8% likely

   CWE-918

3. Server-Side Request Forgery (SSRF) in jgraph/drawioCVE-2022-1767jgraph · CVSS 7.5 · 1.8% likely

   CWE-918

4. Server-Side Request Forgery (SSRF) in jgraph/drawioCVE-2022-1784jgraph · CVSS 7.5 · 1.8% likely

   CWE-918

5. Server-Side Request Forgery (SSRF) in jgraph/drawioCVE-2022-1723jgraph · CVSS 7.5 · 1.7% likely

   CWE-918

6. SSRF in editor's proxy via IPv6 link-local address in jgraph/drawioCVE-2022-1722jgraph · CVSS 7.5 · 0.5% likely

   CWE-918

7. draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jsCVE-2026-76898jgraph · CVSS 7.7 · 0.4% likely

   CWE-918

8. draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklistCVE-2026-63334jgraph · CVSS 6.8 · 0.3% likely

   CWE-918

9. draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hostsCVE-2026-97373jgraph · CVSS 5.8 · 0.2% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.