draw.io: 18,375 Fingerprints Against 309 Titles, and Why Architecture Diagrams Leak Topology
Architecture diagrams name hosts, subnets and data flows. A fingerprint count of 18,375 against 309 title matches says most draw.io deployments are embedded where a title search will never find them.
iagrams are the part of documentation nobody classifies. A network diagram names hosts, subnets and trust boundaries. An architecture diagram names services and the message bus between them. A cloud diagram, exported in the default embedding style, carries resource identifiers that map to real infrastructure. draw.io is the tool most teams reach for, and a self-hosted instance is where those diagrams accumulate.
Query results
Measured through ZoomEye on 2026-10-23, page size one, all sub-types:
app="draw.io"returned 18,375.title="draw.io"returned 309.
Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJkcmF3LmlvIg%3D%3D
A ratio of roughly sixty to one is the widest in this set. The explanation is structural rather than surprising. The draw.io application is frequently embedded inside another product: an issue tracker macro, a wiki plugin, a documentation portal. The fingerprint identifies the embedded application, while the page title belongs to the host product and never mentions draw.io at all. A defender searching by title sees three hundred results and concludes the surface is small. The fingerprint says otherwise.
Neither number counts instances that hold sensitive diagrams, because there is no query for that. A public instance that hosts only a template gallery is harmless. A private instance inside a procurement portal that hosts network maps is a different object entirely, and both answer the same fingerprint.
Why the content matters more than the application
draw.io is close to stateless. The value is in the documents, and the documents are reconnaissance. Consider what an attacker collects from a diagram:
- Hostnames and internal DNS suffixes, which reduce the effort of guessing services.
- Subnet ranges and the location of the trust boundary, which identifies where a pivot is worth attempting.
- Cloud resource names and regions, which become targets for enumeration against public APIs.
- Data flow arrows, which name the systems that hold regulated data without needing to compromise anything.
None of that requires an exploit. It requires a diagram, and diagrams are shared because sharing them is the point. The exposure here belongs to information architecture, and the tool is only the container.
The collaborative editing angle
Self-hosted draw.io deployments often enable storage integration: a filesystem volume, an S3-compatible bucket, a Git repository or an integration with the host wiki. Each of those connections introduces a path from the diagram editor to a data store. A deployment configured to write into a shared bucket with broad permissions extends the blast radius beyond the diagrams to whatever else the bucket holds.
The same configuration question decides whether one user can read another's diagrams. Default filesystem-backed deployments store files under predictable paths, and a deployment that was not reviewed for multi-tenant separation will serve documents to anyone who knows the name.
Assessing your own installations
- Find where the application is embedded rather than where it is installed. Wiki macros, tracker plugins and documentation portals are the places it hides.
- Determine which deployments accept anonymous access and what repository backs them.
- Classify the diagrams themselves. A network map and a template gallery do not belong in the same repository with the same permissions.
- Check storage integration credentials, since a compromised editor inherits whatever the bucket policy grants.
- Review exported content that has been published to a public site or pasted into a ticket, because the file is already out and the query results are not the only distribution channel.
Limitations
ZoomEye totals describe observed hosts, not a complete inventory of the internet, and the numbers move as crawl windows change. Fingerprint matching identifies an application responding on an address; it does not determine whether the deployment is authenticated, what it stores or who can read it. A title-based count understates embedded deployments badly, which is the whole point of reporting both.
References
- ZoomEye application fingerprint query for draw.io, run 2026-10-23, total 18,375.
- ZoomEye title query for draw.io, run 2026-10-23, total 309.
- draw.io documentation covering storage backends, embedding and access control.
Did you enjoy this article?
Recommend it — Standard Reader surfaces well-loved writing to more readers across the network.