CVE-2026-57171: Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output path without path-traversal validation, allowing arbitrary file write outside the Trestle workspace. These commands join the user-supplied output argument onto the Trestle root and write to the result, but guard it only with an isdirectorynameallowed() task-name-collision check rather than the PathSecurityValidator.validatelocalpath() guard used by the jinja command, so an absolute path or one containing traversal sequences escapes the workspace and writes files under an attacker-chosen location as the invoking process owner. The security boundary is crossed when a trusted CI job, shared service, or wrapper derives the output argument from repository-controlled, tenant-controlled, or otherwise untrusted data while expecting output to stay inside the workspace. When --force-overwrite is used, the selected output directory is first recursively deleted, extending the primitive to destruction of an attacker-chosen directory tree and enabling indirect code execution by overwriting files a pipeline later runs. This issue is fixed in versions 3.12.4 and 4.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.0 - Configuration
Do not use --force-overwrite, because when enabled the selected output directory is first recursively deleted, extending arbitrary file write to attacker-chosen directory tree destruction.
Trestle (author generate commands: catalog-generate/profile-generate/ssp-generate) --force-overwrite = false
Event History
Frequently Asked Questions
What attacker control is needed to reach the vulnerable write path?
An attacker must be able to influence the output argument supplied to a catalog-generate, profile-generate, or ssp-generate author command. This is most relevant when a CI job, shared service, or wrapper derives that argument from repository-controlled, tenant-controlled, or other untrusted data.
Which execution environments are most exposed?
The primary exposure is automation that assumes generated output will remain within the Trestle workspace while accepting untrusted input for the output location. Files are written with the permissions of the process invoking Trestle, so the impact depends on that process owner's accessible paths.
Can the issue cause deletion as well as file creation or modification?
Yes. When --force-overwrite is used, Trestle recursively deletes the selected output directory before writing generated content, which can extend the impact to attacker-selected directories outside the workspace.
Which command families are affected?
The affected author commands are catalog-generate, profile-generate, and ssp-generate. The issue affects versions before 3.12.4 and versions from 4.0.0 through 4.0.3.