CVE-2026-81838

Received Received - Intake

Path Traversal in AWS Diagram-as-Code

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: AMZN

Description

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-81838

Affected Vendors & Products

Vendor	Product	Version / Range
aws	diagram-as-code	From 0.10 (inc) to 0.24 (exc)
aws	diagram-as-code	From 0.10 (inc) to 0.23 (inc)
aws	diagram-as-code	0.24

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

CVE-2026-81838 is a Zip Slip path traversal vulnerability in the AWS diagram-as-code (awsdac) tool. It occurs when awsdac extracts a zip archive referenced in a definition file, allowing a crafted archive to write files outside the intended cache directory to any writable path on the system. This could lead to arbitrary code execution if malicious files are written.

Detection Guidance

Check the version of awsdac installed on your system. If it is between 0.10 and 0.23, the system is vulnerable. Run 'awsdac --version' to verify the installed version.

Impact Analysis

This vulnerability allows a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could enable the attacker to perform inappropriate actions in the diagram bundle or execute arbitrary code if malicious files are written.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if it leads to unauthorized file writes on systems handling sensitive data. Arbitrary file writes might expose or alter protected information, violating confidentiality requirements. However, the CVE specifically states the issue does not impact AWS services, accounts, or customer data, as awsdac operates locally.

Mitigation Strategies

Upgrade awsdac to version 0.24 or later immediately. Avoid using untrusted definition files or the --allow-untrusted-definitions flag. Ensure CI/CD pipelines only process reviewed, trusted files.

Hi! I’m here to help you understand CVE-2026-81838. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70