Path Traversal Vulnerability in compliance-trestle Tooling Platform
CVE-2026-45774
6.9MEDIUM
What is CVE-2026-45774?
The compliance-trestle tooling platform for compliance as code contains a path traversal vulnerability in its profile import mechanism. Prior to versions 3.12.2 and 4.0.3, the library does not adequately verify the boundaries of resolved file paths, potentially allowing an attacker to exploit this flaw. By crafting a YAML profile with malicious path sequences, an attacker could read unauthorized files from the server's filesystem, leading to sensitive data exposure. The issue has been addressed in versions 3.12.3 and 4.0.3.
Affected Version(s)
compliance-trestle < 3.12.2 < 3.12.2
compliance-trestle >= 4.0.0, < 4.0.3 < 4.0.0, 4.0.3