https://vulnerability.circl.lu/sightings/feed 2026-10-12T08:39:08.541184+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/87dd9904-1477-4db2-b485-3dab1bb70047/export 2026-10-12T08:39:08.565607+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "87dd9904-1477-4db2-b485-3dab1bb70047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57171", "type": "seen", "source": "https://gist.github.com/alon710/a4de1914db8651dc41f80ba1f3047b71", "content": "# CVE-2026-57171: CVE-2026-57171: Path Traversal and Arbitrary File Write in compliance-trestle\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57171\n\n## Summary\nCVE-2026-57171 describes an incomplete fix of CVE-2026-46345 inside compliance-trestle. Sibling subcommands (catalog-generate, profile-generate, ssp-generate, create, and replicate) bypass path validation routines. An attacker can manipulate output parameters to perform arbitrary file writes and directory deletions.\n\n## TL;DR\nAn incomplete security fix in compliance-trestle allows path traversal, arbitrary file write, and recursive directory deletion across multiple subcommands by manipulating the output path parameter.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Local\n- **CVSS Severity Score**: 7.7\n- **EPSS Score**: 0.00211\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- compliance-trestle (Python Library & CLI Tool)\n- **compliance-trestle**: < 3.12.4 (Fixed in: `3.12.4`)\n- **compliance-trestle**: >= 4.0.0, <= 4.0.3 (Fixed in: `4.1.0`)\n\n## Mitigation\n\n- Upgrade compliance-trestle to patched versions immediately.\n- Incorporate input validation filters within CI/CD parameter engines.\n- Minimize the operational permissions of automated build runners.\n\n**Remediation Steps:**\n1. Identify active installations of compliance-trestle in pipelines and developer environments.\n2. For v3.x installations, update requirements to enforce '>=3.12.4'.\n3. For v4.x installations, update requirements to enforce '>=4.1.0'.\n4. Audit active execution flows to ensure no command parameters are sourced directly from unvalidated inputs.\n\n## References\n\n- [GitHub Security Advisory GHSA-r4vp-3vw6-r2x5](https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-r4vp-3vw6-r2x5)\n- [Secondary Advisory Reference GHSA-4q5v-7g7x-j79w](https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-4q5v-7g7x-j79w)\n- [NVD Vulnerability Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-57171)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57171) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T03:30:32.000000Z"} 2026-09-25T03:30:32+00:00 https://vulnerability.circl.lu/sighting/b8a4ef37-d099-45d2-b606-f5dd7860d442/export 2026-10-12T08:39:08.567084+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "b8a4ef37-d099-45d2-b606-f5dd7860d442", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57171", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-r4vp-3vw6-r2x5", "content": "", "creation_timestamp": "2026-09-24T19:52:34.000000Z"} 2026-09-24T19:52:34+00:00 https://vulnerability.circl.lu/sighting/3a245ba8-126f-423e-842d-7456e0428527/export 2026-10-12T08:39:08.567886+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3a245ba8-126f-423e-842d-7456e0428527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57171", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ar4qbv6h6ay2d", "content": "CVE-2026-57171 - Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)\nCVE ID : CVE-2026-57171\n \n Published : Aug. 25, 2026, 11:39 p.m. | 27\u00a0minutes ago\n \n Description : Compliance-trestle (Trestle) is a...", "creation_timestamp": "2026-08-26T00:34:57.428956Z"} 2026-08-26T00:34:57.428956+00:00