CVE-2026-46345 PUBLISHED

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

Assigner: GitHub_M
Reserved: 13.05.2026 Published: 17.08.2026 Updated: 17.08.2026

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, ..\, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.4

Product Status

Vendor oscal-compass
Product compliance-trestle
Versions
  • Version >= 4.0.0, < 4.0.3 is affected
  • Version < 3.12.2 is affected

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
  • CWE-36: Absolute Path Traversal CWE
  • CWE-73: External Control of File Name or Path CWE