Skip to content
Threat Feed

Tag

CI/CD Compromise

1 brief RSS
high advisory

compliance-trestle Arbitrary File Write via Path Traversal

The compliance-trestle application is vulnerable to arbitrary file write via path traversal; the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace due to improper validation of path traversal characters, leading to potential CI/CD compromise or local code execution by overwriting sensitive files such as `.github/workflows/*.yml` or `.git/hooks/*`.

compliance-trestle +1 arbitrary file write path traversal github actions CI/CD compromise
2r 3t