Awslabs/tough suffered from incomplete path traversal protection. Before version 0.22.0, remote authenticated users with delegated signing authority could create or overwrite files outside the intended output directories by supplying absolute paths in copy_target or link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write. Because the library trusted the joined destination path without performing containment verification after resolution, attackers could write to arbitrary file locations, enabling breach of confidentiality and integrity of critical files.

Affected products are the AWS tough and tuftool libraries. Versions prior to tough‑v0.22.0 and tuftool‑v0.15.0 are vulnerable. Administrators should verify that the currently deployed binaries are older than these releases.

With a CVSS of 7.1 the vulnerability is considered moderate to high risk, but the EPSS is below 1 % and the issue is not in the CISA KEV catalog, indicating a low current exploitation rate. Attackers need a legitimate signed request that includes the vulnerable path parameters; no local code execution is required. The flaw is therefore constrained to users who have delegated signing rights, but once an attacker gains that capability the write permission enables destructive actions.