CVE-2026-107608CWE-59

CVE-2026-107608

Medium · published October 9, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
3.1
In the wild
Unconfirmed
What it is

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset.

To remediate this issue, users should upgrade to version 2.267.0 or later.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00141 · 3.1th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-10-09T00:17Z
References (2)
https://aws.amazon.com/security/security-bulletins/2026-131-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/aws/aws-cdk/releases/tag/v2.267.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 19:36Z
    Improper link resolution in asset bundling output handling in aws-cdk-lib
    cvelistv5
  • 08 OCT 19:36Z
    Improper link resolution in asset bundling output handling in aws-cdk-lib
    cvelistv5