Answer in brief
CVE-2026-46380 records a Medium severity path traversal vulnerability in compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
Answer in brief
CVE-2026-46380 records a Medium severity path traversal vulnerability in compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
Update compliance-trestle to 4.0.3; compliance-trestle to 3.12.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-46380 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| compliance-trestlepip | >=4.0.0,<4.0.3 | 4.0.3 |
| compliance-trestlepip | <3.12.2 | 3.12.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-46380 records a Medium severity path traversal vulnerability in compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for compliance-trestle, compliance-trestle.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate compliance-trestle to 4.0.3; compliance-trestle to 3.12.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-46380 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| compliance-trestlepip | >=4.0.0,<4.0.3 | 4.0.3 |
| compliance-trestlepip | <3.12.2 | 3.12.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-46380 records a Medium severity path traversal vulnerability in compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem. The source record does not mark it as known exploited. 2 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for compliance-trestle, compliance-trestle.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardA source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. **Finding 1 (Critical): SSRF (CWE-918)** The HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints (e.g., 169.254.169.254). Per [rule 4.2.11 of the CVE CNA rules](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_4-2_CVE_ID_Assignment) Finding 1 will be addressed in this advisory, while findings 2 & 3 will be addressed in separate advisories: --- Multiple Path Traversal Vulnerabilities in Remote Fetching Subsystem **Finding 2 & 3 (High/Medium): Path Traversal (CWE-22)** The caching logic for HTTPSFetcher and LocalFetcher fails to sanitize URI paths, allowing for arbitrary file reads via file:// or writing cached files outside the intended directory. Impact: > These vulnerabilities can be chained to exfiltrate sensitive cloud credentials or compromise CI/CD environments. Reproduction: > Please see the attached poc_ssrf_and_path_traversal.py and terminal_output.txt. 13 exploit vectors have been verified locally. [compliance-trestle_audit_2026-03-30.pdf](https://github.com/user-attachments/files/26348930/compliance-trestle_audit_2026-03-30.pdf) [poc_ssrf_and_path_traversal.py](https://github.com/user-attachments/files/26348820/poc_ssrf_and_path_traversal.py) [terminal_output.txt](https://github.com/user-attachments/files/26348821/terminal_output.txt)
A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. **Finding 1 (Critical): SSRF (CWE-918)** The HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints (e.g., 169.254.169.254). Per [rule 4.2.11 of the CVE CNA rules](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_4-2_CVE_ID_Assignment) Finding 1 will be addressed in this advisory, while findings 2 & 3 will be addressed in separate advisories: --- Multiple Path Traversal Vulnerabilities in Remote Fetching Subsystem **Finding 2 & 3 (High/Medium): Path Traversal (CWE-22)** The caching logic for HTTPSFetcher and LocalFetcher fails to sanitize URI paths, allowing for arbitrary file reads via file:// or writing cached files outside the intended directory. Impact: > These vulnerabilities can be chained to exfiltrate sensitive cloud credentials or compromise CI/CD environments. Reproduction: > Please see the attached poc_ssrf_and_path_traversal.py and terminal_output.txt. 13 exploit vectors have been verified locally. [compliance-trestle_audit_2026-03-30.pdf](https://github.com/user-attachments/files/26348930/compliance-trestle_audit_2026-03-30.pdf) [poc_ssrf_and_path_traversal.py](https://github.com/user-attachments/files/26348820/poc_ssrf_and_path_traversal.py) [terminal_output.txt](https://github.com/user-attachments/files/26348821/terminal_output.txt)