{"id":"CVE-2026-7237","summary":"AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal","details":"A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27. Affected by this issue is some unknown functionality of the file packages/scaffold-mcp/src/server/index.ts of the component write-to-file Tool. The manipulation of the argument file_path results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.1.0 can resolve this issue. The patch is identified as c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6. You should upgrade the affected component.","modified":"2026-08-12T03:51:49.540529945Z","published":"2026-04-28T06:45:13.690Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7237.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7237.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7237"},{"type":"ADVISORY","url":"https://vuldb.com/submit/802836"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/359845"},{"type":"REPORT","url":"https://github.com/AgiFlow/aicode-toolkit/issues/88"},{"type":"REPORT","url":"https://vuldb.com/vuln/359845/cti"},{"type":"FIX","url":"https://github.com/AgiFlow/aicode-toolkit/commit/c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6"},{"type":"FIX","url":"https://github.com/AgiFlow/aicode-toolkit/pull/89"},{"type":"FIX","url":"https://github.com/AgiFlow/aicode-toolkit/releases/tag/%40agiflowai/aicode-toolkit%401.1.0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/agiflow/aicode-toolkit","events":[{"introduced":"a4f8e5e3103afdd496e526eac9ae0da4431ffcef"},{"fixed":"c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"introduced":"1.0.1"},{"last_affected":"1.0.1"},{"introduced":"1.0.2"},{"last_affected":"1.0.2"},{"introduced":"1.0.3"},{"last_affected":"1.0.3"},{"introduced":"1.0.4"},{"last_affected":"1.0.4"},{"introduced":"1.0.5"},{"last_affected":"1.0.5"},{"introduced":"1.0.6"},{"last_affected":"1.0.6"},{"introduced":"1.0.7"},{"last_affected":"1.0.7"},{"introduced":"1.0.8"},{"last_affected":"1.0.8"},{"introduced":"1.0.9"},{"last_affected":"1.0.9"},{"introduced":"1.0.10"},{"last_affected":"1.0.10"},{"introduced":"1.0.11"},{"last_affected":"1.0.11"},{"introduced":"1.0.12"},{"last_affected":"1.0.12"},{"introduced":"1.0.13"},{"last_affected":"1.0.13"},{"introduced":"1.0.14"},{"last_affected":"1.0.14"},{"introduced":"1.0.15"},{"last_affected":"1.0.15"},{"introduced":"1.0.16"},{"last_affected":"1.0.16"},{"introduced":"1.0.17"},{"last_affected":"1.0.17"},{"introduced":"1.0.18"},{"last_affected":"1.0.18"},{"introduced":"1.0.19"},{"last_affected":"1.0.19"},{"introduced":"1.0.20"},{"last_affected":"1.0.20"},{"introduced":"1.0.21"},{"last_affected":"1.0.21"},{"introduced":"1.0.22"},{"last_affected":"1.0.22"},{"introduced":"1.0.23"},{"last_affected":"1.0.23"},{"introduced":"1.0.24"},{"last_affected":"1.0.24"},{"introduced":"1.0.25"},{"last_affected":"1.0.25"},{"introduced":"1.0.26"},{"last_affected":"1.0.26"},{"introduced":"1.0.27"},{"last_affected":"1.0.27"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","@agiflowai/one-mcp@0.3.19","@agiflowai/one-mcp@0.3.18","@agiflowai/one-mcp@0.3.17","@agiflowai/one-mcp@0.3.16","@agiflowai/style-system@0.0.13","@agiflowai/scaffold-mcp@1.0.27","@agiflowai/one-mcp@0.3.15","@agiflowai/hooks-adapter@0.0.21","@agiflowai/coding-agent-bridge@1.0.23","@agiflowai/architect-mcp@1.0.25","@agiflowai/aicode-utils@1.0.20","@agiflowai/aicode-toolkit@1.0.26","@agiflowai/style-system@0.0.12","@agiflowai/scaffold-mcp@1.0.26","@agiflowai/one-mcp@0.3.14","@agiflowai/hooks-adapter@0.0.20","@agiflowai/coding-agent-bridge@1.0.22","@agiflowai/architect-mcp@1.0.24","@agiflowai/aicode-utils@1.0.19","@agiflowai/aicode-toolkit@1.0.25","@agiflowai/style-system@0.0.11","@agiflowai/scaffold-mcp@1.0.25","@agiflowai/one-mcp@0.3.13","@agiflowai/hooks-adapter@0.0.19","@agiflowai/coding-agent-bridge@1.0.21","@agiflowai/architect-mcp@1.0.23","@agiflowai/aicode-utils@1.0.18","@agiflowai/aicode-toolkit@1.0.24","@agiflowai/style-system@0.0.10","@agiflowai/scaffold-mcp@1.0.24","@agiflowai/one-mcp@0.3.12","@agiflowai/hooks-adapter@0.0.18","@agiflowai/coding-agent-bridge@1.0.20","@agiflowai/architect-mcp@1.0.22","@agiflowai/aicode-utils@1.0.17","@agiflowai/aicode-toolkit@1.0.23","@agiflowai/style-system@0.0.9","@agiflowai/scaffold-mcp@1.0.23","@agiflowai/one-mcp@0.3.11","@agiflowai/hooks-adapter@0.0.17","@agiflowai/coding-agent-bridge@1.0.19","@agiflowai/architect-mcp@1.0.21","@agiflowai/aicode-utils@1.0.16","@agiflowai/aicode-toolkit@1.0.22","@agiflowai/style-system@0.0.8","@agiflowai/scaffold-mcp@1.0.22","@agiflowai/one-mcp@0.3.10","@agiflowai/hooks-adapter@0.0.16","@agiflowai/coding-agent-bridge@1.0.18","@agiflowai/architect-mcp@1.0.20","@agiflowai/aicode-utils@1.0.15","@agiflowai/aicode-toolkit@1.0.21","@agiflowai/one-mcp@0.3.9","@agiflowai/style-system@0.0.7","@agiflowai/scaffold-mcp@1.0.21","@agiflowai/one-mcp@0.3.8","@agiflowai/hooks-adapter@0.0.15","@agiflowai/coding-agent-bridge@1.0.17","@agiflowai/architect-mcp@1.0.19","@agiflowai/aicode-utils@1.0.14","@agiflowai/aicode-toolkit@1.0.20","@agiflowai/clawdbot-mcp-plugin@0.1.2","@agiflowai/style-system@0.0.6","@agiflowai/scaffold-mcp@1.0.20","@agiflowai/one-mcp@0.3.7","@agiflowai/hooks-adapter@0.0.14","@agiflowai/coding-agent-bridge@1.0.16","@agiflowai/clawdbot-mcp-plugin@0.1.1","@agiflowai/architect-mcp@1.0.18","@agiflowai/aicode-utils@1.0.13","@agiflowai/aicode-toolkit@1.0.19","@agiflowai/clawdbot-mcp-plugin@0.1.0","@agiflowai/style-system@0.0.5","@agiflowai/scaffold-mcp@1.0.19","@agiflowai/one-mcp@0.3.6","@agiflowai/hooks-adapter@0.0.13","@agiflowai/coding-agent-bridge@1.0.15","@agiflowai/architect-mcp@1.0.17","@agiflowai/aicode-utils@1.0.12","@agiflowai/aicode-toolkit@1.0.18","@agiflowai/scaffold-mcp@1.0.18","@agiflowai/style-system@0.0.4","@agiflowai/scaffold-mcp@1.0.17","@agiflowai/one-mcp@0.3.5","@agiflowai/hooks-adapter@0.0.12","@agiflowai/coding-agent-bridge@1.0.14","@agiflowai/architect-mcp@1.0.16","@agiflowai/aicode-utils@1.0.11","@agiflowai/aicode-toolkit@1.0.17","@agiflowai/architect-mcp@1.0.15","@agiflowai/scaffold-mcp@1.0.16","@agiflowai/scaffold-mcp@1.0.15","@agiflowai/architect-mcp@1.0.14","@agiflowai/aicode-toolkit@1.0.16","@agiflowai/hooks-adapter@0.0.11","@agiflowai/architect-mcp@1.0.13","@agiflowai/hooks-adapter@0.0.10","@agiflowai/one-mcp@0.3.4","@agiflowai/coding-agent-bridge@1.0.13","@agiflowai/coding-agent-bridge@1.0.12","@agiflowai/one-mcp@0.3.3","@agiflowai/hooks-adapter@0.0.9","@agiflowai/aicode-toolkit@1.0.15","one-mcp@0.2.8","@agiflowai/scaffold-mcp@1.0.12","@agiflowai/hooks-adapter@0.0.6","@agiflowai/aicode-toolkit@1.0.12","one-mcp@0.3.2","@agiflowai/style-system@0.0.3","@agiflowai/scaffold-mcp@1.0.14","@agiflowai/hooks-adapter@0.0.8","@agiflowai/coding-agent-bridge@1.0.11","@agiflowai/architect-mcp@1.0.12","@agiflowai/aicode-utils@1.0.10","@agiflowai/aicode-toolkit@1.0.14","@agiflowai/aicode-toolkit@1.0.13","@agiflowai/style-system@0.0.2","@agiflowai/scaffold-mcp@1.0.13","@agiflowai/hooks-adapter@0.0.7","one-mcp@0.3.1","one-mcp@0.3.0","one-mcp@0.2.7","@agiflowai/scaffold-mcp@1.0.11","@agiflowai/coding-agent-bridge@1.0.10","@agiflowai/architect-mcp@1.0.11","@agiflowai/style-system@0.0.1","one-mcp@0.2.6","@agiflowai/scaffold-mcp@1.0.10","@agiflowai/hooks-adapter@0.0.5","@agiflowai/coding-agent-bridge@1.0.9","@agiflowai/architect-mcp@1.0.10","@agiflowai/aicode-utils@1.0.9","@agiflowai/aicode-toolkit@1.0.11","one-mcp@0.2.5","@agiflowai/scaffold-mcp@1.0.9","@agiflowai/hooks-adapter@0.0.4","@agiflowai/coding-agent-bridge@1.0.8","@agiflowai/architect-mcp@1.0.9","@agiflowai/aicode-utils@1.0.8","@agiflowai/aicode-toolkit@1.0.10","one-mcp@0.2.4","@agiflowai/scaffold-mcp@1.0.8","@agiflowai/hooks-adapter@0.0.3","@agiflowai/coding-agent-bridge@1.0.7","@agiflowai/architect-mcp@1.0.8","@agiflowai/aicode-utils@1.0.7","@agiflowai/aicode-toolkit@1.0.9","one-mcp@0.2.3","@agiflowai/scaffold-mcp@1.0.7","@agiflowai/hooks-adapter@0.0.2","@agiflowai/coding-agent-bridge@1.0.6","@agiflowai/architect-mcp@1.0.7","@agiflowai/aicode-utils@1.0.6","@agiflowai/aicode-toolkit@1.0.8","one-mcp@0.2.2","@agiflowai/scaffold-mcp@1.0.6","@agiflowai/hooks-adapter@0.0.1","@agiflowai/coding-agent-bridge@1.0.5","@agiflowai/architect-mcp@1.0.6","@agiflowai/aicode-utils@1.0.5","@agiflowai/aicode-toolkit@1.0.7","@agiflowai/aicode-toolkit@1.0.6","@agiflowai/scaffold-mcp@1.0.5","@agiflowai/hooks-adapter@0.0.0","@agiflowai/aicode-utils@1.0.4","@agiflowai/architect-mcp@1.0.5","one-mcp@0.2.1","@agiflowai/coding-agent-bridge@1.0.4","one-mcp@0.2.0","v1.0.3","v1.0.2","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7237.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}