A path traversal vulnerability in the AWS aws-transform-mcp-server tool allows attackers to bypass directory restrictions and access sensitive files on the host system.

The vulnerability is a path traversal issue (CWE-22) located in the get_resource tool. It does not require authentication but does require user interaction, allowing an attacker to escape the intended directory boundaries.

Successful exploitation allows an attacker to read arbitrary files from the server's filesystem, which may contain configuration secrets, credentials, or proprietary source code. While the CVSS score of 8.6 reflects a high severity, the necessity for user interaction somewhat moderates the immediate attack surface.

Immediate Action: Update to the latest version of the aws-transform-mcp-server (0.1.5 or later) via the Python Package Index (PyPI).

Proactive Monitoring: Inspect application logs for sequences resembling directory traversal attempts, such as multiple occurrences of dot-dot-slash patterns in file requests.

Compensating Controls: Ensure the service runs with the least privilege necessary, specifically restricting filesystem access via OS-level permissions or container isolation.

Public Exploit Available: No (exploit_available: false)

Users of the aws-transform-mcp-server should update to version 0.1.5 immediately to mitigate the risk of directory traversal. Restricting the service's access to the filesystem is a critical defensive measure to minimize the impact of potential future vulnerabilities.