CVE-2026-7237: AgiFlow scaffold-mcp Path Traversal Flaw

CVE-2026-7237 Overview

A path traversal vulnerability has been identified in AgiFlow scaffold-mcp versions up to 1.0.27. This security flaw affects the write-to-file tool functionality within the file packages/scaffold-mcp/src/server/index.ts. The vulnerability allows attackers to manipulate the file_path argument to traverse directories outside the intended workspace, potentially enabling unauthorized file writes to arbitrary locations on the target system.

Critical Impact
Remote attackers can exploit improper input validation in the file path parameter to write files outside the designated workspace directory, potentially leading to arbitrary file overwrites, code injection, or system compromise.

Affected Products

AgiFlow scaffold-mcp versions up to 1.0.27
AgiFlow aicode-toolkit packages utilizing the vulnerable WriteToFileTool component

Discovery Timeline

2026-04-28 - CVE CVE-2026-7237 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7237

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the AgiFlow scaffold-mcp package's write-to-file tool. The vulnerability stems from insufficient validation of user-supplied file paths before file write operations are performed. When processing the file_path parameter, the application fails to properly sanitize directory traversal sequences such as ../, allowing attackers to escape the intended workspace directory boundary.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it accessible to unauthenticated remote attackers. Successful exploitation can result in unauthorized file writes to sensitive system locations, potentially enabling attackers to overwrite configuration files, inject malicious code, or compromise application integrity.

Root Cause

The root cause of this vulnerability is the absence of proper path canonicalization and boundary validation in the WriteToFileTool component. Prior to the patch, the application accepted file paths directly without verifying whether the resolved path remained within the workspace directory. This allowed directory traversal sequences to be processed, enabling writes to locations outside the intended scope.

Attack Vector

The attack is network-based and can be launched remotely against systems running vulnerable versions of scaffold-mcp. An attacker can craft a malicious request containing directory traversal sequences in the file_path parameter (e.g., ../../etc/config) to write content to arbitrary file system locations. The exploit has been publicly disclosed, increasing the risk of active exploitation.

typescript

// Security patch implementing workspace boundary validation
// Source: https://github.com/AgiFlow/aicode-toolkit/commit/c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6

     this.fileSystemService = new FileSystemService();
   }
 
+  private resolveWorkspaceFilePath(filePath: string): string {
+    const workspaceRoot = path.resolve(process.cwd());
+    const resolvedPath = path.resolve(workspaceRoot, filePath);
+    const relativeToWorkspace = path.relative(workspaceRoot, resolvedPath);
+    const isWithinWorkspace =
+      !relativeToWorkspace.startsWith(`..${path.sep}`) &&
+      relativeToWorkspace !== '..' &&
+      !path.isAbsolute(relativeToWorkspace);
+
+    if (!isWithinWorkspace) {
+      throw new Error(`Path "${filePath}" is outside the workspace directory`);
+    }
+
+    return resolvedPath;
+  }
+
   /**
    * Get the tool definition for MCP
    */

The patch introduces a resolveWorkspaceFilePath method that canonicalizes the input path and validates it remains within the workspace root directory before permitting file operations.

Detection Methods for CVE-2026-7237

Indicators of Compromise

Unexpected file modifications or creations outside the designated workspace directories
Log entries showing file write operations with path traversal sequences (../, ..\\)
Anomalous file system activity targeting sensitive configuration files or system directories
Application error logs indicating path validation failures after patching

Detection Strategies

Monitor file system operations from scaffold-mcp processes for writes to directories outside the workspace root
Implement application-level logging to capture all file_path parameters passed to the write-to-file tool
Deploy file integrity monitoring (FIM) on critical system directories to detect unauthorized modifications
Use web application firewalls (WAF) or input validation rules to detect path traversal patterns in requests

Monitoring Recommendations

Enable verbose logging for the scaffold-mcp server component to track file operation requests
Configure alerts for file write attempts containing directory traversal sequences
Monitor for changes to the packages/scaffold-mcp/src/tools/WriteToFileTool.ts file to ensure patches are applied
Review application dependencies regularly to identify vulnerable scaffold-mcp versions

How to Mitigate CVE-2026-7237

Immediate Actions Required

Upgrade AgiFlow scaffold-mcp to version 1.1.0 or later immediately
Audit file system permissions to ensure the application runs with least privilege
Review logs for evidence of exploitation attempts using path traversal patterns
Implement network segmentation to limit exposure of vulnerable services

Patch Information

The vulnerability has been addressed in version 1.1.0 of the AgiFlow aicode-toolkit. The security fix is identified by commit hash c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6. Organizations should upgrade to the patched version through standard package management.

Additional resources:

Workarounds

If immediate patching is not possible, restrict network access to the scaffold-mcp service to trusted sources only
Implement input validation at the network or application gateway level to reject requests containing path traversal sequences
Run the scaffold-mcp service within a containerized environment with restricted file system access
Apply file system permissions to limit write access to only necessary directories

bash

# Configuration example - Upgrade to patched version
npm update @agiflowai/scaffold-mcp@1.1.0

# Verify installed version
npm list @agiflowai/scaffold-mcp