A relative path traversal bug in the ZIP extraction logic of AWS Diagram‑as‑Code allows a third party to write files to arbitrary locations on the local filesystem. The flaw is triggered by crafted ZIP entry names that include path traversal sequences. If an attacker can supply such a ZIP, they can overwrite or create files, potentially leading to unauthorized configuration changes or persistence within the diagram bundle. This weakness is a classic path traversal issue catalogued as CWE‑23.

The weakness affects the AWS Diagram‑as‑Code product, specifically versions 0.10 through 0.23. Users who have installed these releases are impacted. The accepted fix is to upgrade to version 0.24 or later, which removes the vulnerable extraction logic.

The severity is a CVSS score of 6.8. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating it has not yet been broadly exploited. The attack requires an attacker to supply a malformed ZIP to the application, which is a local or untrusted‑source scenario. Once executed, the attacker can write arbitrary files, granting them inappropriate access or control within the diagram bundle. Given the medium‑level score and lack of known exploitation evidence, vigilance is advised while ensuring systems run the patched version.