CyberRota Analysis
AI-GeneratedThe compliance-trestle tooling platform is vulnerable due to improper validation of file paths in the `-o/--output` argument of the `trestle author jinja` command, allowing attackers to write files to arbitrary locations outside the intended workspace. This high-severity flaw can lead to unauthorized file manipulation and potential system compromise. Organizations using versions prior to 3.12.3 or 4.0.3 should prioritize updating to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.