Executive brief
compliance-trestle is a tool used to manage OSCAL compliance documentation and control catalogs. The author generate commands (catalog-generate, profile-generate, ssp-generate) contain a path traversal vulnerability in their output directory handling that allows an attacker who controls the --output argument to write files outside the intended workspace directory. In CI/automation pipelines where the output path is derived from untrusted data, this could enable arbitrary file creation or (with --force-overwrite) recursive deletion of attacker-chosen directories on the system.
Technical details
The vulnerability is a path traversal flaw in the author subcommands (catalog-generate, profile-generate, ssp-generate) where the --output argument is joined directly with the trestle_root without proper validation. Unlike the fixed jinja command, these generate commands rely only on is_directory_name_allowed() for checking the output directory name, which validates only the first path component and does not prevent absolute paths or non-leading .. segments. An attacker can supply absolute paths (e.g., /tmp/escape) or relative paths with traversal sequences (e.g., subdir/../../../../../../tmp/escape) to write markdown files outside the workspace. The --force-overwrite flag compounds the risk by recursively deleting the target directory (via shutil.rmtree) before writing, enabling destructive attacks. The fix is to call PathSecurityValidator.validate_local_path() immediately after constructing the markdown_path, mirroring the remediation applied to the jinja command in CVE-2026-46345.
Affected products
- compliance-trestle compliance-trestle up to and including v4.0.3
Timeline
- 2026-09-24: disclosed: Advisory GHSA-r4vp-3vw6-r2x5 published
- 2026-01-01: other: Related CVE-2026-46345 (jinja path traversal) patched in v4.0.3, but fix not applied to generate commands