Loading vulnerability…
CVE-2026-18953 is a path traversal vulnerability in the get_resource tool of Amazon awslabs.aws-transform-mcp-server affecting versions 0.1.0 through 0.1.4. The flaw stems from improper limitation of a pathname to a restricted directory when processing the savePath parameter, allowing a context-dependent actor to cause files to be written outside the intended working directory. Because the vulnerable code permits arbitrary file write via attacker-influenced path selection, exploitation can cross directory boundaries and place content in unintended filesystem locations. In environments where written files are subsequently executed, loaded, or trusted by local processes, this can lead to local code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a self-contained Python proof-of-concept for CVE-2026-18953, an arbitrary file write/path traversal issue in awslabs.aws-transform-mcp-server versions 0.1.0 through 0.1.4. The repo contains six files: a README describing the vulnerability and attack scenarios, the main PoC driver (poc.py), a small loguru shim used only to satisfy imports, and two vendored copies of the upstream file_validation.py module representing the vulnerable 0.1.4 code and the fixed 0.1.5 code. The exploit capability is a local arbitrary file write primitive reachable through the server’s get_resource workflow when attacker-controlled savePath and fileName values are passed into validate_write_path(). The vulnerable implementation resolves save_path and strips directory components from file_name, but does not confine writes to a safe base directory and does not enforce the blocked filename list on writes. As a result, an attacker-controlled MCP client or indirectly influenced agent can write downloaded content to arbitrary filesystem locations via absolute paths, traversal-style save paths, or sensitive filenames such as .bashrc or authorized_keys. The PoC demonstrates three cases: absolute-path escape, relative ../../ traversal, and sensitive dotfile overwrite. poc.py does not attack AWS directly. Instead, it recreates the vulnerable control flow locally: it loads the real upstream validators from vendor/, installs a shim for loguru, starts a temporary local HTTP server to emulate the presigned S3 download source, and writes a benign marker payload to disk using the same validation/write logic. This makes the repository a genuine exploit PoC rather than a scanner or detection script. It proves exploitation by showing that the vulnerable validator writes outside the intended sandbox while the fixed validator raises ValueError. The fixed 0.1.5 vendored module shows the remediation: all writes must remain under an allow-listed base directory derived from AWS_TRANSFORM_MCP_WRITE_DIR or the server’s current working directory, and blocked filenames are enforced on writes as well as reads. Overall, the repository’s purpose is to document root cause, reproduce the bug safely in a disposable temp directory, and contrast vulnerable versus patched behavior.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.