Haozhe Wu

**Name of the Vulnerable Software and Affected Versions** Vibe-Trading versions prior to 0.1.10 **Description** The application constructs the proposal file path by joining a caller-supplied proposal identifier to the broker proposals directory without proper sanitization in the `agent/src/live/mandate/commit.py` file. An attacker can use path traversal sequences—a technique used to access files and directories outside the intended folder—within the proposal identifier to force the application to load a malicious JSON file as an authoritative live trading mandate. When used in conjunction with the file upload endpoint, an authenticated user can upload a JSON file to a known location and traverse to it. Since the system skips validation when ceilings are absent, the attacker can gain full control over the committed mandate. **Recommendations** Update Vibe-Trading to version 0.1.10 or later.