CVE-2026-7237
Full vulnerability record from the local CVENow database.
Description
A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27. Affected by this issue is some unknown functionality of the file packages/scaffold-mcp/src/server/index.ts of the component write-to-file Tool. The manipulation of the argument file_path results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.1.0 can resolve this issue. The patch is identified as c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6. You should upgrade the affected component.
Severity
MEDIUM
CVSS score
5.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-04-28 08:16:02.640000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-7237",
"sourceIdentifier": "[email protected]",
"published": "2026-04-28T08:16:02.640",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27. Affected by this issue is some unknown functionality of the file packages/scaffold-mcp/src/server/index.ts of the component write-to-file Tool. The manipulation of the argument file_path results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.1.0 can resolve this issue. The patch is identified as c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6. You should upgrade the affected component."
},
{
"lang": "es",
"value": "Una vulnerabilidad fue detectada en AgiFlow scaffold-mcp hasta la versión 1.0.27. Afectada por este problema es alguna funcionalidad desconocida del archivo packages/scaffold-mcp/src/server/index.ts del componente write-to-file Tool. La manipulación del argumento file_path resulta en salto de ruta. El ataque puede ser lanzado remotamente. El exploit es ahora público y puede ser usado. La actualización a la versión 1.1.0 puede resolver este problema. El parche se identifica como c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6. Debería actualizar el componente afectado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "AgiFlow",
"product": "scaffold-mcp",
"modules": [
"write-to-file Tool"
],
"versions": [
{
"version": "1.0.0",
"status": "affected"
},
{
"version": "1.0.1",
"status": "affected"
},
{
"version": "1.0.2",
"status": "affected"
},
{
"version": "1.0.3",
"status": "affected"
},
{
"version": "1.0.4",
"status": "affected"
},
{
"version": "1.0.5",
"status": "affected"
},
{
"version": "1.0.6",
"status": "affected"
},
{
"version": "1.0.7",
"status": "affected"
},
{
"version": "1.0.8",
"status": "affected"
},
{
"version": "1.0.9",
"status": "affected"
},
{
"version": "1.0.10",
"status": "affected"
},
{
"version": "1.0.11",
"status": "affected"
},
{
"version": "1.0.12",
"status": "affected"
},
{
"version": "1.0.13",
"status": "affected"
},
{
"version": "1.0.14",
"status": "affected"
},
{
"version": "1.0.15",
"status": "affected"
},
{
"version": "1.0.16",
"status": "affected"
},
{
"version": "1.0.17",
"status": "affected"
},
{
"version": "1.0.18",
"status": "affected"
},
{
"version": "1.0.19",
"status": "affected"
},
{
"version": "1.0.20",
"status": "affected"
},
{
"version": "1.0.21",
"status": "affected"
},
{
"version": "1.0.22",
"status": "affected"
},
{
"version": "1.0.23",
"status": "affected"
},
{
"version": "1.0.24",
"status": "affected"
},
{
"version": "1.0.25",
"status": "affected"
},
{
"version": "1.0.26",
"status": "affected"
},
{
"version": "1.0.27",
"status": "affected"
},
{
"version": "1.1.0",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-28T14:13:09.359948Z",
"id": "CVE-2026-7237",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://github.com/AgiFlow/aicode-toolkit/commit/c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6",
"source": "[email protected]"
},
{
"url": "https://github.com/AgiFlow/aicode-toolkit/issues/88",
"source": "[email protected]"
},
{
"url": "https://github.com/AgiFlow/aicode-toolkit/pull/89",
"source": "[email protected]"
},
{
"url": "https://github.com/AgiFlow/aicode-toolkit/releases/tag/%40agiflowai/aicode-toolkit%401.1.0",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/802836",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/359845",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/359845/cti",
"source": "[email protected]"
}
]
}