Vibe‑Trading before version 0.1.10 contains a path traversal flaw in the construction of the swarm run directory. A crafted swarm run identifier is concatenated onto the base runs directory without proper validation, enabling a missing audit of the path. The result is that the application can read arbitrary run.json files residing outside the intended directory and can overwrite existing run.json files in traversed locations. This represents a classic path traversal weakness (CWE‑22) that permits an attacker to access or modify files on the host system.

The vulnerable product is Vibe‑Trading v0.1.9 and earlier, released by HKUDS. No other affected versions are listed in the authoritative CNA data.

The CVSS score of 2.3 indicates low complexity and limited impact in the formal metric, and the EPSS score is not available. KEV is not flagged. The vulnerability requires the ability to supply a custom run identifier via the MCP swarm tools, a capability typically available to users with access to the Vibe‑Trading system. The attack surface is therefore constrained to nodes where the swarm tools are operational, but within that scope an attacker could read or overwrite arbitrary configuration files. While the formal severity is low, the potential for unauthorized file modification warrants patching or mitigation.