## https://sploitus.com/exploit?id=127719D1-1C6C-5538-8B6F-DDEA4F4BCA34
# CVE-2026-18953 — PoC
Arbitrary file write in **`awslabs.aws-transform-mcp-server`** (AWS Transform MCP
server) via the `savePath` parameter of the `get_resource` tool.
| | |
|---|---|
| **CVE** | [CVE-2026-18953](https://www.cve.org/cverecord?id=CVE-2026-18953) |
| **CWE** | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory |
| **Affected** | `awslabs.aws-transform-mcp-server` 0.1.0 – 0.1.4 |
| **Fixed in** | 0.1.5 |
| **CVSS v3.1** | 8.6 HIGH — `AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` |
| **CVSS v4.0** | 6.3 MEDIUM — `AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H` |
| **Advisory** | [GHSA-66mr-jr63-2jgw](https://github.com/awslabs/mcp/security/advisories/GHSA-66mr-jr63-2jgw) |
| **Bulletin** | [AWS Security Bulletin 2026-075](https://aws.amazon.com/security/security-bulletins/2026-075-aws/) |
| **Reporter** | Drew Raines (coordinated disclosure) |
| **Published** | 2026-08-05 |
## Summary
`get_resource(resource="artifact" | "asset", ...)` downloads a file from a
pre-signed S3 URL and, when the caller passes `savePath` / `fileName`, saves it
to local disk through:
```
tools/get_resource.py -> tool_utils.download_s3_content()
-> file_validation.validate_write_path()
```
In ` Absolute path escape (no traversal needed at all)
RESULT: VULNERABLE: wrote OUTSIDE sandbox -> .../outside_sandbox/dropped_by_absolute_path.sh
-> Relative "../../.." traversal out of the sandbox dir
RESULT: VULNERABLE: wrote OUTSIDE sandbox -> .../outside_sandbox/dropped_by_traversal.sh
-> Sensitive dotfile name, written inside a decoy $HOME
RESULT: VULNERABLE: wrote OUTSIDE sandbox -> .../outside_sandbox/decoy_home/.bashrc
=== Target: file_validation.py from 0.1.5-fixed ===
-> Absolute path escape (no traversal needed at all)
RESULT: BLOCKED (raised ValueError): Write path must be within the working directory (...)
-> Relative "../../.." traversal out of the sandbox dir
RESULT: BLOCKED (raised ValueError): ...
-> Sensitive dotfile name, written inside a decoy $HOME
RESULT: BLOCKED (raised ValueError): ...
```
## Remediation
Upgrade to `awslabs.aws-transform-mcp-server >= 0.1.5`. There is no
server-side workaround for older versions; the advisory recommends upgrading.
Operators who cannot upgrade immediately should run the server with its CWD
set to a dedicated, empty directory and treat any file it can write to as
compromised.
## Repo layout
```
README.md — this file
poc.py — self-contained PoC driver
vendor/_loguru_shim.py — tiny stand-in for the `loguru` dep (test scaffolding only)
vendor/0.1.4-vulnerable/file_validation.py — real vulnerable source, from PyPI sdist
vendor/0.1.5-fixed/file_validation.py — real patched source, from github.com/awslabs/mcp@main
```