The compliance-trestle platform is vulnerable to path traversal attacks in versions prior to 4.0.3 and 3.12.2, potentially leading to unauthorized file access or modification.

The application suffers from improper limitation of pathnames, including absolute path traversal and external control of file paths. This allows an attacker to manipulate file operations, potentially leading to unauthorized data disclosure or system-wide impacts.

Path traversal vulnerabilities can allow attackers to read sensitive configuration files, source code, or internal system data. With a CVSS score of 8.4, the risk of total technical impact is significant, potentially leading to a full compromise of the local environment where the tool is running.

Immediate Action: Update the compliance-trestle package to version 4.0.3 or 3.12.2, depending on the current branch in use.

Proactive Monitoring: Monitor file system access logs for attempts to access directories or files outside of the expected application path.

Compensating Controls: Run the application with the principle of least privilege, ensuring the process owner has minimal access to the underlying operating system files.

Public Exploit Available: Unknown

The existence of a proof-of-concept makes this a credible threat. Users should verify their current version and apply the appropriate update immediately to prevent unauthorized file system access.