{"id":"CVE-2026-107608","published":"2026-10-08T20:17:34.967","lastModified":"2026-10-08T21:33:42.423","description":"Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset.\n\n\n\nTo remediate this issue, users should upgrade to version 2.267.0 or later.","cvssScore":5.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-131-aws/","tags":[]},{"url":"https://github.com/aws/aws-cdk/releases/tag/v2.267.0","tags":[]}],"exploitRefs":[{"url":"https://github.com/aws/aws-cdk/releases/tag/v2.267.0","tags":[]}],"hasPoc":true,"ai":null}