PT-2026-35682 · Agiflow · Scaffold-Mcp

Brucejin · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7237

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AgiFlow scaffold-mcp versions prior to 1.1.0

Description A path traversal issue exists in the write-to-file Tool within the packages/scaffold-mcp/src/server/index.ts file. A remote attacker can exploit this by manipulating the file path argument, allowing unauthorized access to or modification of files outside the intended directory.

Recommendations Upgrade to version 1.1.0.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7237

Affected Products

Scaffold-Mcp

References · 10

• 🔥 https://github.com/AgiFlow/aicode-toolkit/issues/88 · Exploit
• https://github.com/AgiFlow/aicode-toolkit/pull/89 · Patch
• https://github.com/AgiFlow/aicode-toolkit/commit/c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6 · Patch
• https://github.com/AgiFlow/aicode-toolkit/releases/tag/%40agiflowai/aicode-toolkit%401.1.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7237 · Security Note
• https://vuldb.com/vuln/359845 · Note
• https://vuldb.com/submit/802836 · Note
• https://t.me/CVEtracker/52060 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2049131961164156971 · Twitter Post
• https://vuldb.com/vuln/359845/cti · Note