Description
Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences through the remember tool. Attackers can manipulate the memory_type parameter in the persistent memory store to cause the application to write arbitrary Markdown files to unintended locations on the filesystem.
Severity (CVSS)
| Base score | 6 |
|---|---|
| Severity | Medium |
| Version | CVSS 4.0 |
| Vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| Provided by | CNA |
Weaknesses
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
| Vendor | Product | Versions |
|---|---|---|
| HKUDS | Vibe-Trading | 0 to <0.1.10 |
References
- https://github.com/HKUDS/Vibe-Trading/releases/tag/v0.1.10 (release-notes)
- https://github.com/HKUDS/Vibe-Trading/pull/257 (issue-tracking)
- https://www.vulncheck.com/advisories/vibe-trading-path-traversal-via-persistent-memory-type (third-party-advisory)
Generated from the official CVE List on 01 Jul 2026 07:05 UTC.