CVE-2026-18953 is a path traversal vulnerability (CWE-22) affecting Amazon's awslabs.aws-transform-mcp-server Python package versions 0.1.0 through 0.1.4. The flaw exists in the get_resource tool, where improper limitation of a pathname to a restricted directory allows a context-dependent attacker to write arbitrary files outside the intended working directory via the savePath parameter. This could enable unauthorized file writes to sensitive locations on the host system. The vulnerability has been assigned a high criticality rating. Amazon has released a patched version (0.1.5) to address the issue. Users are strongly advised to upgrade to version 0.1.5 or later immediately. The advisory is supported by references from AWS Security Bulletins, GitHub Security Advisories, and PyPI.