CVE-2026-58173 is a path traversal vulnerability in HKUDS Vibe-Trading prior to version 0.1.10. The issue arises when the application improperly limits the pathname to a restricted directory, allowing an attacker to supply a crafted memory_type value containing path traversal sequences. This enables writing files outside the designated memory root directory, specifically arbitrary Markdown files, through the remember tool's persistent memory store. The vulnerability requires low privileges (PR:L) and no user interaction (UI:N), with network attack vector (AV:N).

An attacker with limited privileges can exploit this vulnerability to write arbitrary files to unintended locations on the filesystem, potentially leading to integrity issues. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits in the wild have been reported.

No official patch or remediation level has been published yet. Users should monitor the vendor's advisories for updates and apply any official fixes once available. Until then, restrict access to the remember tool and validate or sanitize inputs to the memory_type parameter to prevent path traversal sequences.