CVE-2026-18953

CVE-2026-18953 — PoC Escritura arbitraria de archivos en awslabs.aws-transform-mcp-server servidor MCP de AWS Transform a través del parámetro savePath de la herramienta getresource. | ---|--- CVE| CVE-2026-18953 CWE| CWE-22 — Limitación inadecuada de un nombre de ruta a un directorio restringido...

Exploit for CVE-2026-18953

CVE-2026-18953 — PoC Arbitrary file write in awslabs.aws-t...

CVE-2026-18953

CVE-2026-18953 affects the Amazon awslabs.aws-transform-mcp-server package (versions 0.1.0–0.1.4). The issue is an improper limitation of a pathname to a restricted directory in the get_resource tool, which could allow a context-dependent actor to write arbitrary files outside the intended workin...

CVE-2026-18953 Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-18953

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...