CVE-2026-18953EPSS p4.6%

CVE-2026-18953CVE-2026-18953

Description

Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this issue, users should upgrade to version 0.1.5 or later.

Scoring

CVSS 8.6 ()
VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS0.15% probability of exploitation · percentile 4.6% · 2026-08-06T12:00:30Z
Last modified2026-08-06
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.