CVE-2026-46345
Received Received - Intake

Path Traversal in Compliance-Trestle

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-46345
EUVD
EUVD-2026-60317

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
oscal-compass compliance-trestle to 3.12.2|end_excluding=4.0.3 (exc)
oscal-compass compliance-trestle 3.12.2
oscal-compass compliance-trestle 4.0.3
oscal-compass compliance-trestle From 0.0.2|end_including=4.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-36 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46345 is an arbitrary file write vulnerability in compliance-trestle versions 3.12.1 and earlier. It occurs in the trestle author jinja command where the -o/--output argument is not properly validated. Attackers can use path traversal sequences like ../ or absolute paths to write files outside the intended workspace directory.

Detection Guidance

Check if compliance-trestle versions 3.12.1 or earlier are installed using pip list or pip show compliance-trestle. Inspect command usage logs for trestle author jinja with suspicious -o/--output arguments containing ../, ..\, or absolute paths. Monitor for unexpected file modifications in sensitive directories like .github/workflows/, .git/hooks/, or user home files.

Impact Analysis

This vulnerability allows attackers to overwrite sensitive files such as GitHub Actions workflows, Git hooks, or user configuration files like .bashrc. It could lead to CI/CD compromise, local code execution, or tampering with repository files and compliance artifacts. Exploitation requires only local access and no authentication.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling attackers to overwrite sensitive files such as configuration files, CI/CD workflows, or compliance artifacts. Such tampering might lead to unauthorized data access, integrity breaches, or disruption of compliance-related processes, potentially violating requirements for data protection, auditability, and system integrity.

Mitigation Strategies

Upgrade compliance-trestle to versions 3.12.2, 4.0.3, or later immediately. Avoid using the trestle author jinja command with untrusted input. Review and restrict write permissions for users running trestle commands. Monitor for unauthorized file changes in critical directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart