Executive brief
awsdac is a command-line tool that generates AWS architecture diagrams from code-based definitions. A path traversal vulnerability in zip archive extraction allows an attacker to write files outside the intended directory when processing a malicious diagram definition, potentially leading to arbitrary code execution on the user's machine. This risk is heightened in CI/CD environments that automatically process definition files from untrusted sources.
Technical details
CVE-2026-81838 is a Zip Slip (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) path traversal vulnerability in the zip archive extraction functionality of awsdac. When awsdac processes a ZipFile resource referenced in a diagram definition, it fails to properly validate archive entry paths, allowing a crafted zip file to extract files to arbitrary locations writable by the invoking user. An attacker can exploit this by crafting a malicious diagram definition file containing a specially constructed zip archive with directory traversal sequences (e.g., "../") in filenames. Exploitation requires processing a definition from an untrusted source—either through versions prior to 0.22.4 (which had no trust restrictions) or via LocalFile resource type (which bypasses URL allowlists). Successful exploitation can lead to arbitrary code execution if the attacker writes to executable paths or configuration files. Patch availability: versions 0.22.4 and later mitigate the risk by requiring the --allow-untrusted-definitions flag and introducing definition URL allowlists, though affected versions 0.10–0.23 remain vulnerable.
Affected products
- AWS awsdac 0.10 through 0.23
Timeline
- 2026-08-27: disclosed: AWS Security Bulletin 2026-090-AWS published