CVE-2026-57171: Path Traversal and Arbitrary File Write in compliance-trestle

The Python-based Software Development Kit (SDK) and command-line tool compliance-trestle (Trestle) facilitates the management of Open Security Controls Assessment Language (OSCAL) documents. Trestle relies on structured workspace directories to catalog, profile, and track system security plans. While these operations typically target local repository files, the application-level directory boundaries are frequently used as security boundaries within automated pipelines.

During the remediation of a prior path traversal vulnerability (CVE-2026-46345), engineers introduced validation constraints targeting the jinja subcommand. This specific mitigation validated generated outputs through the PathSecurityValidator.validate_local_path() method. However, this defensive check was not systematically applied across sibling commands that share equivalent output mechanisms.

Consequently, several core command-line modules remained vulnerable to input-controlled path traversal. An attacker capable of defining output arguments can direct the execution environment to write files outside the designated workspace. This configuration also allows directory destruction depending on associated flags.

The vulnerability stems from the incomplete implementation of directory validation checks within sibling commands. Commands such as catalog-generate, profile-generate, ssp-generate, create, and replicate historically bypassed the PathSecurityValidator. Instead, they evaluated user-supplied path inputs via is_directory_name_allowed() which was designed to prevent name collision with core OSCAL directories.

This validation check contained two logical flaws. First, if a path starts with a Unix root separator, pathlib.Path(name).parts[0] resolves to the root directory itself. Because the root directory does not exist in the defined restricted directories, the method returns a truthy validation success. Second, path relative traversals (such as subdir/../../) resolve the first element of parts as subdir, which also successfully passes the constraint checks.

Once authorized, the path joining logic invokes Python's standard pathlib division operator. If the configured path argument is absolute, Python discards the preceding workspace root variable entirely. If the input contains relative directory traversals, the resolved output directory escapes the workspace bounds. Additionally, when a user specifies the --force-overwrite option, the program calls clear_folder(), which recursively deletes the target path before writing files.

The vulnerable code in trestle/common/file_utils.py checked output folders using basic slicing of uncanonicalized path components. It failed to check for absolute paths or relative dot-dot sequences.

# Vulnerable Implementation
def is_directory_name_allowed(name: str) -> bool:
    pathed_name = pathlib.Path(name)
    root_path = pathed_name.parts[0]
    if root_path in const.MODEL_TYPE_TO_MODEL_DIR.values():
        logger.warning('Task name is the same as an OSCAL schema name.')
        return False

The patch addresses this gap by introducing explicit validation checks for both absolute paths and the presence of .. segments inside the file_utils.py validation logic. It also updates the vulnerable command files to call PathSecurityValidator.validate_local_path immediately after constructing the output path.

# Patched Implementation in trestle/common/file_utils.py
def is_directory_name_allowed(name: str) -> bool:
    pathed_name = pathlib.Path(name)
 
    # Reject absolute paths explicitly
    if pathed_name.is_absolute() or name.startswith('/'):
        logger.warning('Task name must not be an absolute path')
        return False
 
    # Reject traversal sequences
    if '..' in pathed_name.parts:
        logger.warning('Task name must not contain ".." path traversal sequences')
        return False
 
    root_path = pathed_name.parts[0]
    if root_path in const.MODEL_TYPE_TO_MODEL_DIR.values():
        logger.warning('Task name is the same as an OSCAL schema name.')
        return False

Additionally, all affected CLI subcommands (e.g., trestle/core/commands/author/catalog.py) were patched to enforce path boundaries:

# Added check in affected commands
markdown_path = trestle_root / args.output
PathSecurityValidator.validate_local_path(markdown_path, trestle_root)

Exploitation requires an execution context where the output file path parameter (-o or --output) is influenced by an untrusted source. This scenario is common in shared, multi-tenant build environments, CI/CD pipelines, or automation scripts that parse user-provided metadata or pull request properties.

An attacker can structure an exploit payload using standard relative path sequences or absolute system paths. When the Trestle utility parses the input argument, it performs the directory validation steps on the uncanonicalized input. The command then executes, leading to directory deletion (if forced) and file placement outside the workspace.

This path-resolution mechanism permits an attacker to targeting sensitive directories on the execution runner, such as /etc/cron.d or /var/www. If the execution runner possesses high privileges, this can lead to system-wide compromise or denial of service.

The impact of CVE-2026-57171 affects system integrity and availability. An attacker can write arbitrary compliance schema files to sensitive operating system paths, potentially overwriting system libraries or configurations.

If the runner process operates with elevated privileges, this primitive enables local privilege escalation. For example, writing arbitrary files to /etc/cron.d or active system service folders allows execution of arbitrary commands. This risk is highly relevant in multi-tenant environments where a single pipeline runs validation workflows on behalf of multiple untrusted repository contributors.

The inclusion of folder clearing logic (clear_folder) also introduces a high-impact availability risk. By pointing the output directory to system-critical paths with force flags active, an attacker can delete directories, resulting in permanent damage to execution environments or build runners.

Remediation requires upgrading the compliance-trestle installation to a safe release version. The patch has been backported to both the 3.x and 4.x branches. Workspaces should transition to 3.12.4 (for v3 deployments) or 4.1.0 (for v4 deployments).

If immediate upgrading is not possible, execution environments must implement input filtering on CLI commands. Ensure that parameters parsed from untrusted inputs are checked for traversal patterns (..) or absolute directories.

Security teams can deploy Semgrep rules to detect instances of unvalidated input patterns in their automation pipelines. Systems can also audit command logs to intercept suspicious traversal patterns targeting Trestle execution targets.