Vulnerability · Published Aug 27, 2026 · Assigned by AMZN

CVE-2026-81838Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

High 7.1

In plain English

A high-severity security flaw in diagram-as-code from aws. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.

Affected products (as reported)

Vendor	Product	Versions
aws	diagram-as-code	0.10 – through 0.23

Weakness: CWE-23 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

https://github.com/awslabs/diagram-as-code/releases/tag/v0.24 release-notes, patch
https://aws.amazon.com/security/security-bulletins/2026-090-aws/ vendor-advisory