PT-2026-44731 · Pypi · Compliance-Trestle
Published
2026-05-28
·
Updated
2026-05-28
·
CVE-2026-46380
CVSS v3.1
6.7
Medium
| Vector | AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N |
A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module.
Finding 1 (Critical): SSRF (CWE-918)
The HTTPSFetcher. do fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints (e.g., 169.254.169.254).
Per [rule 4.2.11 of the CVE CNA rules](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section 4-2 CVE ID Assignment) Finding 1 will be addressed in this advisory, while findings 2 & 3 will be addressed in separate advisories:
Multiple Path Traversal Vulnerabilities in Remote Fetching Subsystem
Finding 2 & 3 (High/Medium): Path Traversal (CWE-22)
The caching logic for HTTPSFetcher and LocalFetcher fails to sanitize URI paths, allowing for arbitrary file reads via file:// or writing cached files outside the intended directory.
Impact: > These vulnerabilities can be chained to exfiltrate sensitive cloud credentials or compromise CI/CD environments.
Reproduction: > Please see the attached poc ssrf and path traversal.py and terminal output.txt. 13 exploit vectors have been verified locally.
[compliance-trestle audit 2026-03-30.pdf](https://github.com/user-attachments/files/26348930/compliance-trestle audit 2026-03-30.pdf)
[poc ssrf and path traversal.py](https://github.com/user-attachments/files/26348820/poc ssrf and path traversal.py)
[terminal output.txt](https://github.com/user-attachments/files/26348821/terminal output.txt)
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Compliance-Trestle