Skip to main content

Vibe-Trading CVE-2026-58171

| EUVDEUVD-2026-40352 LOW
Path Traversal (CWE-22)
2026-06-30 VulnCheck GHSA-mjrq-xg2m-qg94
Path Traversal Vibe Trading
2.3
CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY
2.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.0 MEDIUM

C:L assigned over vendor's C:N because description explicitly confirms arbitrary run.json reads; all other metrics align with the provided vector.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Severity Changed
Jun 30, 2026 - 17:22 NVD
MEDIUM LOW
CVSS changed
Jun 30, 2026 - 17:22 NVD
4.2 (MEDIUM) 2.3 (LOW)
Analysis Generated
Jun 30, 2026 - 17:22 vuln.today

DescriptionCVE.org

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py). A crafted run identifier supplied through the MCP swarm tools causes the application to read arbitrary run.json files outside the runs directory and to overwrite existing run.json files at traversed locations.

AnalysisAI

Path traversal in Vibe-Trading's swarm run directory handler allows low-privileged network attackers to read and overwrite arbitrary run.json files on the host filesystem. All releases before 0.1.10 are affected via the MCP swarm tools interface, where a crafted run identifier is passed to the run_dir function in agent/src/swarm/store.py without sanitization, enabling directory escape. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to MCP swarm tools interface
Delivery
Craft run identifier with path traversal sequences
Exploit
Submit identifier via MCP swarm tool API
Execution
run_dir joins identifier without validation
Persist
Path resolves outside runs base directory
Impact
Read or overwrite target run.json files
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must have low-privilege authenticated access to the MCP swarm tools interface (consistent with CVSS PR:L), meaning unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 3.1 score of 4.2 (Medium) reflects a network-accessible but high-complexity attack (AV:N/AC:H) requiring low-privilege authentication (PR:L) with unchanged scope (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated low-privileged user of a shared Vibe-Trading deployment submits a swarm run identifier containing path traversal sequences (e.g., '../../other-user/sensitive') through the MCP swarm tools API. The run_dir function in agent/src/swarm/store.py joins this value onto the base runs directory without canonicalization, resolving a path outside the intended directory. …
Remediation Upgrade to Vibe-Trading v0.1.10 or later, which resolves the path traversal via the patch committed at https://github.com/HKUDS/Vibe-Trading/commit/f45fd85392f07b5e404e41d4fcb0ef0d6c2f87ab (merged via PR #258, https://github.com/HKUDS/Vibe-Trading/pull/258). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vibe Trading

View all
CVE-2026-58169 HIGH
7.7 Jun 30

Remote code execution in HKUDS Vibe-Trading before 0.1.10 is reachable via a DNS-rebinding attack against its local API

CVE-2026-58170 HIGH
7.2 Jun 30

Trading mandate forgery in HKUDS Vibe-Trading before 0.1.10 lets an admitted (low-privileged) caller supply a proposal i
CVE-2026-58173 MEDIUM
6.0 Jun 30

Path traversal in Vibe-Trading before version 0.1.10 allows low-privileged authenticated network attackers to write arbi

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2026-58171 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy