Vibe-Trading before version 0.1.10 improperly limits pathname traversal when building proposal file paths by joining unsanitized user input to the broker proposals directory path. An attacker can supply a proposal identifier containing path traversal sequences to cause the application to load a malicious JSON file as an authoritative live trading mandate. The presence of a file upload endpoint allows an attacker with admitted caller privileges to write arbitrary JSON files to known locations and then traverse to them. Since the application skips ceilings validation if ceilings are absent, the attacker gains full control over the committed mandate. This vulnerability is classified as a path traversal issue leading to unauthorized file loading and mandate manipulation.

An attacker with admitted caller privileges can exploit this vulnerability to write and load attacker-controlled JSON files as live trading mandates, bypassing validation checks. This results in full control over the committed mandate, potentially impacting integrity and availability of trading operations. The CVSS score of 8.3 reflects high severity with network attack vector, low attack complexity, required privileges, no user interaction, and significant impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict admitted caller privileges to trusted users only and monitor for suspicious file uploads or unauthorized file access attempts related to proposal identifiers. Avoid using vulnerable versions prior to 0.1.10 once a patch is released.