Log in / Sign up

Vulnerability details

CVE-2026-58170

HKUDS Vibe-Trading

Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates

CVSS 4.0
7.2High

Official description

Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py). A proposal identifier containing path traversal sequences causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate. Combined with the file upload endpoint, an admitted caller can write a JSON file to a known location and traverse to it, and because the ceilings validation is skipped when ceilings are absent, the attacker fully controls the committed mandate.

CVSS scores

ScoreVersionSourceVector
7.2High 4.0 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
8.3High 3.1 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Affected products

VendorProductVersionsSource
HKUDS Vibe-Trading v < 0.1.10 CVEProject cvelistV5 (CNA)

References and advisories

4
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-06-30
Last updated
2026-11-08
State
Published
Assigner (CNA)
VulnCheck

Exploit prediction (EPSS)

0.55%
Probability of exploitation in 30 days
46.4%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-22
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')