Vibe-Trading before version 0.1.10 contains a path traversal vulnerability where the proposal file path is built by joining an unsanitized, caller-supplied proposal identifier onto the broker proposals directory. An attacker can upload a malicious JSON file via a file upload endpoint to a known location and then use path traversal sequences in the proposal identifier to cause the application to load this attacker-controlled file as an authoritative live trading mandate. Because the application skips ceilings validation if ceilings are missing, the attacker gains full control over the committed mandate. This vulnerability has a CVSS 3.1 score of 8.3, indicating high severity, with network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and high availability impact.

An attacker with the ability to upload files and supply proposal identifiers can exploit this vulnerability to execute path traversal and load attacker-controlled JSON files as live trading mandates. This leads to full control over the committed mandates, potentially impacting the integrity and availability of trading operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor file upload capabilities and validate or sanitize proposal identifiers to prevent path traversal sequences. Avoid using unsanitized user input in file path construction.