CVE-2026-81838
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path…
Does this matter?
Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.
Description
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.
- CVSS 4.0
- 6.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.15% probability · 4th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-23
- Affected
- amazon/diagram-as-code
- Source
- ff89ba41-3aa1-4d27-914a-91399e9639e5
References
- https://aws.amazon.com/security/security-bulletins/2026-090-aws/Patch, Vendor Advisory
- https://github.com/awslabs/diagram-as-code/releases/tag/v0.24Patch, Release Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.