CVE-2026-81838: Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle.
To remediate this issue, users should upgrade to the version 0.24 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS diagram-as-code (awsdac)to a version that resolves this vulnerability.Fixed in 0.24
Event History
Frequently Asked Questions
Which deployments are affected?
AWS diagram-as-code (awsdac) versions 0.10 through 0.23 are affected. Version 0.24 or later is the stated remediation.
What does an attacker need to exploit this issue?
An attacker needs a victim to process a crafted ZIP archive whose entry names contain path traversal sequences. The attack is local and requires user interaction, but it does not require privileges.
What is the impact of successful exploitation?
A crafted archive can cause arbitrary files to be written to the local filesystem outside the intended extraction location. This can enable inappropriate actions within the diagram bundle context and affects integrity and availability.