Vibe‑Trading before version 0.1.10 is vulnerable to path traversal when constructing a proposal file path from an attacker‑supplied identifier. By supplying a proposal identifier that contains traversal sequences the application can load an arbitrary JSON file as a live trading mandate. Combined with the file upload endpoint, an authorized caller can place a JSON file at a known location and reference it with a malicious identifier, thereby committing the file as a live trading mandate. Because ceiling validation is skipped when ceilings are absent, the attacker can fully control the mandate, potentially executing unauthorized trades and bypassing critical checks. This exploitation is a CWE‑22 path traversal vulnerability.

The vulnerability affects the HKUDS Vibe‑Trading application on all releases prior to 0.1.10. Version 0.1.10 and later include a sanitized path construction and restored ceiling validation that mitigate the issue.

The CVSS score of 7.2 indicates high severity. No EPSS data is available and the vulnerability is not yet listed in CISA KEV, but the exploit is feasible if an attacker has authenticated access to the file upload endpoint. The attack requires the ability to upload a JSON file to the broker proposals directory and craft a path traversal sequence, which is relatively straightforward with minimal skill or automated tooling. Given the potential for financial loss and the lack of mitigations in older versions, the risk is considered high.