Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58173Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type

Medium 6.5

In plain English

A medium-severity path traversal in Vibe-Trading from HKUDS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.

Affected products (as reported)

Vendor	Product	Versions
HKUDS	Vibe-Trading	0 – before 0.1.10

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Release Notes release-notes
Fix PR issue-tracking
https://www.vulncheck.com/advisories/vibe-trading-path-traversal-via-persistent-memory-type third-party-advisory