{"data":{"id":"20efd7c8-68ac-427f-8fa2-a14dd3555f04","title":"CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server","summary":"CVE-2026-15415 is a path traversal flaw in the workflow linting tools of aws-healthomics-mcp-server before version 0.0.36. Directory traversal sequences in the workflow_files input let an actor who can influence the MCP agent write attacker-controlled content to locations outside the intended workflow bundle directory. Versions 0.0.35 and earlier are affected.","solution":"Upgrade aws-healthomics-mcp-server to version 0.0.36 or later.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-060-aws/","publishedAt":"2026-07-17T19:44:21.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS HealthOmics","aws-healthomics-mcp-server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-07-17T19:44:21.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}