A path traversal vulnerability (CVE-2026-7237) was discovered in AgiFlow scaffold-mcp versions up to 1.0.27. The vulnerability affects the write-to-file Tool component in the packages/scaffold-mcp/src/server/index.ts file, where manipulation of the file_path argument leads to path traversal attacks. The vulnerability can be exploited remotely and the exploit code is publicly available. Users should upgrade to version 1.1.0 which contains the security patch identified as commit c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6.