CVE-2026-46345

Published: Ago 17, 2026 Last Modified: Ago 17, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,4
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.

22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: AI/ML
Likelihood of Exploit: High
View CWE Details
36

Absolute Path Traversal

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: Not Technology-Specific, Web Based, AI/ML
View CWE Details
73

External Control of File Name or Path

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Read Files Or Directories Modify Files Or Directories Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Other)
Applicable Platforms
Operating Systems: Unix, Windows, macOS
Likelihood of Exploit: High
View CWE Details
https://github.com/oscal-compass/compliance-trestle/securit…
https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-4q…
https://github.com/oscal-compass/compliance-trestle/commit/…
https://github.com/oscal-compass/compliance-trestle/commit/247fcce289f60103f3d8…
https://github.com/oscal-compass/compliance-trestle/commit/…
https://github.com/oscal-compass/compliance-trestle/commit/7d107b3ac53caca7bde9…
https://github.com/oscal-compass/compliance-trestle/securit…
https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-4q…
https://github.com/pypa/advisory-database/tree/main/vulns/c…
https://github.com/pypa/advisory-database/tree/main/vulns/compliance-trestle/PY…