Description

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-27T20:18:56.900Z",
  "pubdate": "2026-08-27T20:18:56.900Z",
  "executiveSummary": "AWS diagram-as-code (awsdac) versions 0.10 through 0.23 contain a critical path traversal vulnerability within the zip file extraction logic. This flaw allows a malicious actor to craft zip archives containing entry names with path traversal sequences, such as '../', which bypass standard directory validation. When processed by an affected version, the application may inadvertently write files outside of the intended destination directory. The vulnerability poses a significant security risk, as it enables arbitrary file write capabilities on the host filesystem. An attacker can leverage this primitive to overwrite configuration files, inject malicious binaries, or tamper with application components within the diagram bundle environment, potentially leading to unauthorized system access, data compromise, or remote code execution depending on the host's operating environment. This issue does not require specific authentication to trigger, as the exploitation occurs during the automated processing of the provided zip files. Organizations utilizing affected versions of awsdac are exposed to these risks until the software is updated to the remediated version, 0.24 or later.",
  "technicalDetails": "The vulnerability resides within the zip decompression and extraction module of the awsdac utility. The root cause is a failure to properly sanitize or validate the file paths contained within the entries of a ZIP archive. Specifically, the library or custom implementation responsible for unpacking diagram bundles does not adequately check for relative path sequences like '../' or absolute paths that reside outside the designated root directory for extraction.\nThe exploitation flow begins with an attacker creating a malicious zip archive. Within this archive, the attacker includes a file entry with a crafted filename, such as '../../../../home/user/.ssh/authorized_keys' or similar sensitive filesystem locations. When the victim or an automated process invokes the awsdac tool to extract this malicious archive, the extraction function concatenates the untrusted zip entry name with the intended target extraction path without performing canonicalization or path validation.\nBecause the underlying filesystem APIs often resolve these relative paths, the extraction process follows the directory traversal sequences, escaping the sandboxed directory context. This permits the attacker to write, overwrite, or replace files on the host filesystem with arbitrary content defined in the zip entry body. The vulnerability is present in versions 0.10 through 0.23 of the awsdac package.\nNo authentication or specific privileges are required to initiate the attack, as the flaw is triggered upon the execution of the extraction functionality on a malicious zip file. The attack is effective in any context where the utility processes untrusted input. The post-exploitation impact is severe, as the ability to write arbitrary files to the local filesystem can be weaponized to modify system configurations, inject malicious scripts that trigger code execution upon subsequent system operations, or disrupt the integrity of the diagram bundle processing environment. The vulnerability effectively allows an attacker to transition from a controlled file-write operation to potentially achieving persistent unauthorized access, contingent upon the permissions of the process running the awsdac utility."
}