CVE-2026-7237

Vulnerability

Overview

CVE-2026-7237 is a path traversal vulnerability (CWE-22) in the write-to-file tool of @agiflowai/scaffold-mcp (up to and including version 1.0.27). The vulnerability resides in the handling of the file_path argument within packages/scaffold-mcp/src/server/index.ts. The tool accepted absolute paths as-is and resolved relative paths against the current working directory without enforcing any workspace or base-directory boundary, allowing file writes to arbitrary locations on the filesystem [1][4].

Exploitation

The attack is remotely exploitable by any user able to call the MCP interface. An attacker can send a crafted request to the write-to-file tool with an arbitrary file_path and attacker-controlled content. Public exploit code demonstrates writing a file to /tmp/aicode-toolkit-poc.txt using the MCP Inspector [4]. No authentication is required beyond normal MCP access.

Impact

Successful exploitation allows an attacker to write or overwrite arbitrary files writable by the server process. This can lead to integrity loss, configuration corruption, or further compromise of the system [1][4]. The CVSS v3 score is 7.1 of 7.3 (High) reflects the medium attack complexity but high confidentiality and integrity impact.

Mitigation

The vulnerability is patched in version 1.1.0 of @agiflowai/scaffold-mcp, which restricts file writes to the designated workspace directory [2][3]. The fix commit c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6 adds workspace boundary enforcement [2]. Users should immediately upgrade to version 1.1.0 or later.