CVE-2026-58170

Name of the Vulnerable Software and Affected Versions Vibe-Trading versions prior to 0.1.10

Description The application constructs the proposal file path by joining a caller-supplied proposal identifier to the broker proposals directory without proper sanitization in the agent/src/live/mandate/commit.py file. An attacker can use path traversal sequences—a technique used to access files and directories outside the intended folder—within the proposal identifier to force the application to load a malicious JSON file as an authoritative live trading mandate. When used in conjunction with the file upload endpoint, an authenticated user can upload a JSON file to a known location and traverse to it. Since the system skips validation when ceilings are absent, the attacker can gain full control over the committed mandate.

Recommendations Update Vibe-Trading to version 0.1.10 or later.