CVE-2026-81838
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A path traversal vulnerability in the zip extraction functionality of AWS diagram-as-code (awsdac) versions 0.10 through 0.23 allows a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could enable unauthorized actions within the diagram bundle.
Risk Assessment
An attacker could overwrite or create arbitrary files on the system, potentially leading to data integrity compromise or privilege escalation in the environment where the tool is used.
Recommendation
Upgrade to version 0.24 or later immediately, as it contains the fix for this vulnerability.
Original NVD description (English source)
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.