A critical path traversal vulnerability in AgiFlow scaffold-mcp allows unauthenticated remote attackers to perform arbitrary file writes, creating a significant risk of system compromise.

The vulnerability is a path traversal flaw (CWE-22) located in the write-to-file tool within the file packages/scaffold-mcp/src/server/index.ts. The application fails to properly sanitize the file_path argument, allowing an unauthenticated remote attacker to escape the intended directory and write content to arbitrary locations on the filesystem.

The ability to write arbitrary files to the server filesystem poses a severe threat to system integrity and confidentiality. An attacker could overwrite critical configuration files, inject malicious code, or corrupt system data, potentially leading to a full loss of control over the host environment. Given the CVSS score of 7.3, this vulnerability is classified as High, reflecting the ease of exploitation and the potential for significant impact on business operations.

Immediate Action: Upgrade the @agiflowai/scaffold-mcp component to version 1.1.0 or later, which contains the fix implemented in commit c4d23592ae5fb59cfeefc4641e6826f8ac89b9c6.

Proactive Monitoring: Monitor server filesystem access logs for unexpected file creation or modification events, particularly those originating from the MCP interface or service process.

Compensating Controls: If immediate patching is not feasible, restrict network access to the MCP interface using an allow-list or Web Application Firewall (WAF) to prevent unauthorized remote access to the vulnerable tool.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the vulnerability report at https://github.com/AgiFlow/aicode-toolkit/issues/88.

This vulnerability presents a clear and present danger to any deployment of the AgiFlow scaffold-mcp component due to the lack of required authentication and the presence of a public proof-of-concept. Security teams must prioritize updating to version 1.1.0 immediately to eliminate the path traversal vector. Failure to patch leaves the underlying server infrastructure exposed to arbitrary file write attacks, which can be leveraged for further system exploitation.