CVE-2026-18953EPSS p4.6%
CVE-2026-18953CVE-2026-18953
Description
Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter.
To remediate this issue, users should upgrade to version 0.1.5 or later.
Scoring
| CVSS | 8.6 () |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| EPSS | 0.15% probability of exploitation · percentile 4.6% · 2026-08-06T12:00:30Z |
| Last modified | 2026-08-06 |