CVE-2022-1721: 
NixOS vulnerability analysis and mitigation

Path Traversal vulnerability (CVE-2022-1721) was discovered in the WellKnownServlet component of GitHub repository jgraph/drawio versions prior to 18.0.5. The vulnerability allowed attackers to read local files of the web application through path traversal manipulation (NVD, CVE).

The vulnerability exists in the WellKnownServlet component which was designed to serve files from a .well-known directory. The servlet did not properly restrict file access, allowing attackers to traverse directories and read local files within the web application scope. The issue was fixed by limiting the servlet to serve only a single specific file for OneDrive integration (GitHub Commit).

The vulnerability allows unauthorized access to local files within the web application's scope through path traversal attacks. This could potentially expose sensitive configuration files, source code, or other critical application data (NVD).

The vulnerability was patched in drawio version 18.0.5. The fix involves restricting the WellKnownServlet to only serve a single specific file (microsoft-identity-association.json) needed for OneDrive integration, preventing arbitrary file access (GitHub Commit).