Maple Labs

CVE search · CVE-2026-18953

CVE-2026-18953

medium 6.3

Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this issue, users should upgrade to version 0.1.5 or later.

Open in the NVD CVE.org JSON

Details

Status
Analyzed
Published
Last changed
Source
ff89ba41-3aa1-4d27-914a-91399e9639e5
Weakness
CWE-22

Severity

VersionScoreVectorSource
CVSS 4.0 medium 6.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ff89ba41-3aa1-4d27-914a-91399e9639e5Secondary
CVSS 3.1 high 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H ff89ba41-3aa1-4d27-914a-91399e9639e5Secondary
CVSS 3.1 high 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • amazon · aws_transform_mcp_server

References