CVE-2026-81838: CWE-23: Relative Path Traversal in aws diagram-as-code

The vulnerability CVE-2026-81838 affects AWS diagram-as-code (awsdac) in versions 0.10 through 0.23. It arises from improper handling of zip entry names during extraction, enabling relative path traversal. An attacker can exploit this to write files outside the intended extraction directory, potentially leading to unauthorized file creation or modification within the diagram bundle context. AWS has acknowledged the issue and recommends upgrading to version 0.24 or later to remediate the vulnerability.

Exploitation of this vulnerability could allow an unauthenticated attacker with the ability to supply crafted zip files to write arbitrary files on the local filesystem where aws diagram-as-code is run. This could lead to unauthorized modification or insertion of files, impacting the integrity of the diagram bundle. The CVSS 4.0 base score is 6.8 (medium severity), reflecting local attack vector with low complexity but requiring user interaction and resulting in high impact on integrity and availability.

A patch is available. Users should upgrade aws diagram-as-code to version 0.24 or later to remediate this vulnerability. Since this is a cloud service, AWS manages remediation for the cloud-hosted service; users should verify their deployment versions and apply the upgrade accordingly. Refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-090-aws/ for detailed guidance.