CyberRota Analysis
AI-GeneratedA relative path traversal vulnerability in the zip extraction functionality of AWS diagram-as-code versions 0.10 through 0.23 allows attackers to write arbitrary files to the local filesystem by exploiting crafted zip entry names. This could lead to unauthorized actions within the diagram bundle, posing a significant risk to system integrity. Organizations using affected versions should prioritize upgrading to version 0.24 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later.
Related CVEs
Other vulnerabilities affecting the same vendor(s)