What’s Vulnerable › Vulnerabilities

CVE-2026-81838: Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-09-04
• Weakness: CWE-23

Description

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.

Affected products

• aws diagram-as-code: from 0.10 before 0.24 — fixed in 0.24

How to fix

Upgrade to a fixed version: aws diagram-as-code 0.24. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-090-aws/
• https://github.com/awslabs/diagram-as-code/releases/tag/v0.24

Get alerted when CVE-2026-81838 or the next vulnerability affects your stack