CVE-2026-58173
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A path traversal vulnerability in Vibe-Trading before version 0.1.10 allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.
Risk Assessment
The risk involves the ability to overwrite or create files in sensitive system locations, potentially leading to privilege escalation, execution of malicious code, or data integrity compromise.
Recommendation
Immediately update Vibe-Trading to version 0.1.10 or later, which includes a fix that eliminates the path traversal vulnerability.
Other vulnerabilities in Vibe-Trading
See all- CVE-2026-58171Medium
A vulnerability in Vibe-Trading before version 0.1.10 allows reading and overwriting run.json files outside the runs directory. An attacker can supply a crafted run identifier via MCP swarm tools, leading to unauthorized file access.
- CVE-2026-58170High
A path traversal vulnerability in Vibe-Trading before version 0.1.10 allows an attacker to inject path traversal sequences into the proposal identifier when building the proposal file path. This causes the application to load an attacker-controlled JSON file as an authoritative live trading mandate.
- CVE-2026-58169High
A DNS rebinding authentication bypass vulnerability in Vibe-Trading before 0.1.10 allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopback clients combined with missing Host header validation while binding to 0.0.0.0 with credentialed CORS. Attackers can craft a malicious DNS rebinding page to issue authenticated requests to the local API server, reach the shell execution endpoint with a bash-enabled preset, and achieve remote code execution as the API process user while also overwriting LLM and data-source settings to exfiltrate credentials.
Original NVD description (English source)
Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.