A path traversal vulnerability (CVE-2026-7237) was discovered in AgiFlow scaffold-mcp versions up to 1.0.27. The vulnerability affects the write-to-file Tool component in the file packages/scaffold-mcp/src/server/index.ts. Attackers can manipulate the file_path argument to perform path traversal attacks remotely. The exploit is publicly available and can be actively used. The vulnerability has been patched in version 1.1.0 with commit c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6. Users are strongly advised to upgrade to the fixed version immediately.