compliance-trestle — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in compliance-trestle, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-57171	Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345) CWE-22	7.7	High	2026-08-25
CVE-2026-57170	Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439) CWE-94	7.8	High	2026-08-25
CVE-2026-52776	Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 CWE-184	8.6	High	2026-08-25
CVE-2026-54757	Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data CWE-94	7.8	High	2026-08-25
CVE-2026-46345	compliance-trestle - jinja has an Arbitrary File Write via Path Traversal CWE-22	8.4	High	2026-08-17
CVE-2026-46380	compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem CWE-918	6.7	Medium	2026-08-14
CVE-2026-46439	compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI) CWE-94	7.8	High	2026-08-14
CVE-2026-45774	compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal CWE-22	6.9	Medium	2026-08-13
CVE-2026-45725	compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal CWE-73	7.1	High	2026-08-13

All 9 known CVE vulnerabilities affecting compliance-trestle with full Chinese analysis, references, and POCs where available.