AWS tough versions prior to 0.22.0 contain an incomplete fix for path traversal (CWE-22) that allows remote authenticated users with delegated signing authority to write files outside of intended output directories. This is possible via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write. The vulnerability exists because the software trusts the joined destination path without performing post-resolution containment verification, enabling unauthorized file writes. AWS has released tough-v0.22.0 and tuftool-v0.15.0 to fix this issue. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity) with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

An attacker with delegated signing authority can exploit this vulnerability to write files outside the intended directories, potentially leading to unauthorized modification of files and integrity compromise. There is no impact on confidentiality, and availability impact is low. The vulnerability could affect the integrity of the system or data managed by the tough component in AWS cloud services.

AWS recommends upgrading to tough version 0.22.0 or tuftool version 0.15.0, which contain fixes for this path traversal vulnerability. Since this is a cloud service component, AWS manages remediation for the cloud-hosted service. Users should verify they are using the patched versions and consult the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-019-aws/ for the latest guidance.