DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-57171: CVE-2026-57171: Path Traversal and Arbitrary File Write in compliance-trestle

#security #cve #cybersecurity

CVE-2026-57171: Path Traversal and Arbitrary File Write in compliance-trestle

Vulnerability ID: CVE-2026-57171
CVSS Score: 7.7
Published: 2026-09-24

CVE-2026-57171 describes an incomplete fix of CVE-2026-46345 inside compliance-trestle. Sibling subcommands (catalog-generate, profile-generate, ssp-generate, create, and replicate) bypass path validation routines. An attacker can manipulate output parameters to perform arbitrary file writes and directory deletions.

TL;DR

An incomplete security fix in compliance-trestle allows path traversal, arbitrary file write, and recursive directory deletion across multiple subcommands by manipulating the output path parameter.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Local
  • CVSS Severity Score: 7.7
  • EPSS Score: 0.00211
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • compliance-trestle (Python Library & CLI Tool)
  • compliance-trestle: < 3.12.4 (Fixed in: 3.12.4)
  • compliance-trestle: >= 4.0.0, <= 4.0.3 (Fixed in: 4.1.0)

Code Analysis

Commit: 37ed44f

Fix path traversal vulnerability on main/v4 branch across multiple subcommands

File: trestle/common/file_utils.py\n@@ -105,6 +105,17 @@\n+    if pathed_name.is_absolute() or name.startswith('/'):\n+        logger.warning('Task name must not be an absolute path')\n+        return False\n+\n+    if '..' in pathed_name.parts:\n+        logger.warning('Task name must not contain ".." path traversal sequences')\n+        return False
Enter fullscreen mode Exit fullscreen mode

Commit: 5335ff8

Backport security fix for path traversal vulnerabilities to 3.x branch

Exploit Details

Mitigation Strategies

  • Upgrade compliance-trestle to patched versions immediately.
  • Incorporate input validation filters within CI/CD parameter engines.
  • Minimize the operational permissions of automated build runners.

Remediation Steps:

  1. Identify active installations of compliance-trestle in pipelines and developer environments.
  2. For v3.x installations, update requirements to enforce '>=3.12.4'.
  3. For v4.x installations, update requirements to enforce '>=4.1.0'.
  4. Audit active execution flows to ensure no command parameters are sourced directly from unvalidated inputs.

References

Read the full report for CVE-2026-57171 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)