CVE-2026-57171— Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Quick assessment
Affected
oscal-compass compliance-trestle
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Compliance-trestle（Trestle）是一个用于管理 OSCAL 合规文档的 Python SDK 和命令行工具。在 3.12.4 之前的版本以及 4.0.0 到 4.0.3 版本中， 、 和 作者命令会将生成的 Markdown 文件写入一个由攻击者可控的输出路径，且未进行路径遍历校验，从而导致任意文件被写入到 Trestle 工作区之外。 这些命令会将用户提供的输出参数与 Trestle 根目录拼接，并写入到结果路径中，但其防护措施仅依赖于 的任务名冲突检查，而未采用 命令所使用的 安全校验机制
Possible ATT&CK Techniques 3 AI
T1489 · Service Stop T1048 · Exfiltration Over Alternative Protocol T1059 · Command and Scripting InterpreterAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| oscal-compass | compliance-trestle | < 3.12.4 |
affected |
>= 4.0.0, < 4.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57171
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Source: CVE Program / CVE List V5
Vulnerability Description
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output path without path-traversal validation, allowing arbitrary file write outside the Trestle workspace. These commands join the user-supplied output argument onto the Trestle root and write to the result, but guard it only with an is_directory_name_allowed() task-name-collision check rather than the PathSecurityValidator.validate_local_path() guard used by the jinja command, so an absolute path or one containing traversal sequences escapes the workspace and writes files under an attacker-chosen location as the invoking process owner. The security boundary is crossed when a trusted CI job, shared service, or wrapper derives the output argument from repository-controlled, tenant-controlled, or otherwise untrusted data while expecting output to stay inside the workspace. When --force-overwrite is used, the selected output directory is first recursively deleted, extending the primitive to destruction of an attacker-chosen directory tree and enabling indirect code execution by overwriting files a pipeline later runs. This issue is fixed in versions 3.12.4 and 4.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| oscal-compass | compliance-trestle | < 3.12.4 | - |
|
II. Public POCs for CVE-2026-57171
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Verified env
Premium
Qwen3.6-35B-A3B
· 12016 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-57171
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57171 (1)
Vendor Advisories for CVE-2026-57171 (2)
Same Patch Batch · oscal-compass · 2026-08-25 · 4 CVEs total
| CVE-2026-52776 | 8.6 HIGH | Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 |
| CVE-2026-54757 | 7.8 HIGH | Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of |
| CVE-2026-57170 | 7.8 HIGH | Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE |
IV. Related Vulnerabilities
Same product: compliance-trestle
-
CVE-2026-57170
Trestle SSTI in Jinja2 include tags allows arbitrary code ex -
CVE-2026-52776
Trestle URLSecurityValidator SSRF allowlist bypass via IPv4- -
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recurs -
CVE-2026-46345
compliance-trestle - jinja has an Arbitrary File Write via P -
CVE-2026-46380
compliance-trestle Vulnerable to SSRF in Remote Fetching Sub
Same vendor: oscal-compass
-
CVE-2026-57170
Trestle SSTI in Jinja2 include tags allows arbitrary code ex -
CVE-2026-52776
Trestle URLSecurityValidator SSRF allowlist bypass via IPv4- -
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recurs -
CVE-2026-46345
compliance-trestle - jinja has an Arbitrary File Write via P -
CVE-2026-46380
compliance-trestle Vulnerable to SSRF in Remote Fetching Sub
Same weakness: CWE-22
-
CVE-2026-61792
Weblate path traversal allows a project administrator to rea -
CVE-2026-63179
Winter: Local File Inclusion through @import directives in L -
CVE-2026-81030
Mage AI through 0.9.79 Arbitrary File Read via Unvalidated P -
CVE-2026-81028
ZLMediaKit downloadFile Root-Directory Confinement Bypass vi -
CVE-2026-54550
IzPack: Path Traversal in UnpackerBase allows writing files
V. Comments for CVE-2026-57171
No comments yet