Vulnerability Description
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Diagram-As-Code | >= 0.10, < 0.24 |
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/2026-090-aws/PatchVendor Advisory
- https://github.com/awslabs/diagram-as-code/releases/tag/v0.24PatchRelease Notes
FAQ
What is CVE-2026-81838?
CVE-2026-81838 is a vulnerability with a CVSS score of 7.1 (HIGH). A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesyst...
How severe is CVE-2026-81838?
CVE-2026-81838 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81838?
Check the references section above for vendor advisories and patch information. Affected products include: Amazon Diagram-As-Code.