CVE-2026-58173 is a path traversal vulnerability in HKUDS Vibe-Trading before version 0.1.10. The issue arises because the application improperly limits the pathname to a restricted directory when handling the memory_type parameter in the remember tool. Attackers with limited privileges can supply malicious path traversal sequences to cause the application to write arbitrary Markdown files outside the intended memory root directory, potentially overwriting or injecting files in unintended filesystem locations.

The vulnerability allows an attacker with limited privileges to write arbitrary files outside the designated directory, impacting the integrity of the system by enabling unauthorized file creation or modification. There is no direct impact on confidentiality or availability according to the CVSS vector and description.

No official patch or remediation level is currently confirmed. Users should upgrade to version 0.1.10 or later once available. Until then, restrict access to the remember tool and validate or sanitize inputs to the memory_type parameter to prevent path traversal sequences. Monitor vendor advisories for official fixes.