To remediate this issue, users should upgrade to version 0.1.5 or later.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| AWS | aws-transform-mcp-server | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 05 Aug 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this issue, users should upgrade to version 0.1.5 or later. | |
| Title | Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server | |
| First Time appeared |
Aws
Aws aws-transform-mcp-server |
|
| Weaknesses | CWE-22 | |
| CPEs | cpe:2.3:a:aws:aws-transform-mcp-server:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Aws
Aws aws-transform-mcp-server |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2026-08-05T19:33:10.800Z
Reserved: 2026-08-05T13:44:42.972Z
Link: CVE-2026-18953
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-05T20:30:06Z
-
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')