Awslabs/tough suffered from incomplete path traversal protection. The flaw permits remote authenticated users that have delegated signing authority to write files outside designated output directories by supplying absolute target names in copy_target, link_target, or symlinked parents in save_target, as well as symlinked metadata filenames in SignedRole::write. This unchecked path resolution allows an attacker to overwrite files outside the intended directories, impacting confidentiality and integrity.

Affected products are the AWS tough and tuftool libraries. Versions prior to tough‑v0.22.0 and tuftool‑v0.15.0 are vulnerable. Administrators should verify that the currently deployed binaries are older than these releases.

With a CVSS of 7.1 the vulnerability is considered moderate to high risk, but the EPSS is below 1 % and the issue is not in the CISA KEV catalog, indicating a low current exploitation rate. Attackers need a legitimate signed request that includes the vulnerable path parameters; no local code execution is required. The flaw is therefore constrained to users who have delegated signing rights, but once an attacker gains that capability the write permission enables destructive actions.