CVE-2026-114606: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jgraph drawio-desktop

draw.io Desktop, the official Electron build of draw.io, is vulnerable to arbitrary local-file disclosure through its Electron main process's read-side IPC handlers before version 31.4.4. The affected handlers (readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, watchFile) accept filesystem paths chosen by the renderer process without enforcing a blessed-path authorization (assertWritablePath). Only a URL-prefix origin check (validateSender) and limited checks for readFile (content sniff and lexical appBaseDir prefix block) are in place. Write-side handlers are properly protected by assertWritablePath, creating a read/write authorization asymmetry that allows any frame executing in the app's file:// origin to read local files that it is forbidden to write. This vulnerability is addressed in draw.io Desktop version 31.4.4.

An attacker controlling or able to inject content into a frame running in the app's file:// origin can read arbitrary local files on the user's system that the application otherwise restricts from write access. This can lead to unauthorized disclosure of sensitive local files. The vulnerability does not allow privilege escalation or remote code execution but compromises local file confidentiality.

This vulnerability is fixed in draw.io Desktop version 31.4.4. Users and administrators should upgrade to version 31.4.4 or later to remediate this issue. No additional mitigations are indicated by the vendor advisory.