# CVE-2026-57171: compliance-trestle author generate path traversal file write

Source: https://junglewise.ai/threats/cve-2026-57171-compliance-trestle-author-generate-path-traversal-file-write  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-57171 · Severity: high · CVSS 8.4 · Published 2026-08-26

compliance-trestle is a tool used to manage OSCAL compliance documentation and control catalogs. The author generate commands (catalog-generate, profile-generate, ssp-generate) contain a path traversal vulnerability in their output directory handling that allows an attacker who controls the --output argument to write files outside the intended workspace directory. In CI/automation pipelines where the output path is derived from untrusted data, this could enable arbitrary file creation or (with --force-overwrite) recursive deletion of attacker-chosen directories on the system.

Technologies: [compliance-trestle (PyPI)](https://junglewise.ai/threats/technologies/compliance-trestle). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-57171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57171 being exploited in the wild.

**How severe is CVE-2026-57171?** High severity, with a CVSS score of 8.4, published 26 August 2026.

**Which products and versions are affected?** compliance-trestle (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.4, ECOSYSTEM:introduced=0,fixed=3.12.4,introduced=4.0.0,fixed=4.1.0.

**Is there a fix for CVE-2026-57171?** Yes. compliance-trestle (PyPI): upgrade to 3.12.4, 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57171 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-57171?** Check whether you run compliance-trestle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- compliance-trestle (PyPI): upgrade to 3.12.4, 4.1.0 or later

  ```sh
  pip install "compliance-trestle>=4.1.0"
  ```


## Technical details

The vulnerability is a path traversal flaw in the author subcommands (catalog-generate, profile-generate, ssp-generate) where the --output argument is joined directly with the trestle_root without proper validation. Unlike the fixed jinja command, these generate commands rely only on is_directory_name_allowed() for checking the output directory name, which validates only the first path component and does not prevent absolute paths or non-leading .. segments. An attacker can supply absolute paths (e.g., /tmp/escape) or relative paths with traversal sequences (e.g., subdir/../../../../../../tmp/escape) to write markdown files outside the workspace. The --force-overwrite flag compounds the risk by recursively deleting the target directory (via shutil.rmtree) before writing, enabling destructive attacks. The fix is to call PathSecurityValidator.validate_local_path() immediately after constructing the markdown_path, mirroring the remediation applied to the jinja command in CVE-2026-46345.

## Affected products

- compliance-trestle compliance-trestle up to and including v4.0.3

## Identifiers

- CVE-2026-57171
- GHSA-r4vp-3vw6-r2x5
- PYSEC-2026-4030

## Timeline

- 2026-09-24: disclosed: Advisory GHSA-r4vp-3vw6-r2x5 published
- 2026-01-01: other: Related CVE-2026-46345 (jinja path traversal) patched in v4.0.3, but fix not applied to generate commands

## Related threats

- [Compliance-trestle server-side template injection in Jinja2 tags](https://junglewise.ai/threats/cve-2026-57170-compliance-trestle-server-side-template-injection-in-jinja2-tags)
- [compliance-trestle SSRF allowlist bypass in URLSecurityValidator](https://junglewise.ai/threats/cve-2026-52776-compliance-trestle-ssrf-allowlist-bypass-in-urlsecurityvalidator)
- [oscal-compass compliance-trestle path traversal in jinja command](https://junglewise.ai/threats/cve-2026-46345-oscal-compass-compliance-trestle-path-traversal-in-jinja-command)
- [IBM compliance-trestle path traversal in profile import](https://junglewise.ai/threats/cve-2026-45774-ibm-compliance-trestle-path-traversal-in-profile-import)
- [IBM compliance-trestle arbitrary file write via cache path traversal](https://junglewise.ai/threats/cve-2026-45725-ibm-compliance-trestle-arbitrary-file-write-via-cache-path)