CVE-2026-58170

High

Description

Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.

SeverityHigh

CVSS8.3

Exploit probability46. percentile0.6%

ProductVibe-Trading

PublishedJun 30, 2026

First seenJun 30, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

HKUDS Vibe-Trading0.1.10 or later

Patches

github.com/HKUDS/Vibe-Trading/commit/0ab701302f90e701c9dc558a898a217a376610c3

Vendor advisories

github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10

Affected products

Product	Affected versions	Fixed in
HKUDS Vibe-Trading	v < 0.1.10	0.1.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.