CVE-2026-18953CWE-22path-traversal

CVE-2026-18953

High · published August 6, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter.

To remediate this issue, users should upgrade to version 0.1.5 or later.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-06T00:17Z
Affected products (1)
ProductVersionsFixed in
amazon/aws_transform_mcp_server≥ 0.1.0, < 0.1.50.1.5
References (3)
https://aws.amazon.com/security/security-bulletins/2026-075-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/awslabs/mcp/security/advisories/GHSA-66mr-jr63-2jgw · ff89ba41-3aa1-4d27-914a-91399e9639e5https://pypi.org/project/awslabs.aws-transform-mcp-server/0.1.5/ · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 05 AUG 19:33Z
    Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server
    cvelistv5