vulnerability / NVI-00015112 / Revision 2
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
GitHub lists this reviewed advisory for compliance-trestle, compliance-trestle. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
6.7 medium
GitHub source severity; exploitability and local consequence require separate evidence.
As of · GitHub Advisory Database
0.142%
FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.03566. Missing scores are unknown.
As of · FIRST EPSS
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
compliance-trestle
source listed>= 4.0.0, < 4.0.3
A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. **Finding 1 (Critical): SSRF (CWE-918)** The HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints (e.g., 169.254.169.254). Per rule 4.2.11 of the CVE CNA rules Finding 1 will be addressed in this advisory, while findings 2 & 3 will be addressed in separate advisories: --- Multiple Path Traversal Vulnerabilities in Remote Fetching Subsystem **Finding 2 & 3 (High/Medium): Path Traversal (CWE-22)** The caching logic for HTTPSFetcher and LocalFetcher fails to sanitize URI paths, allowing for arbitrary file reads via file:// or writing cached files outside the intended directory. Impact: > These vulnerabilities can be chained to exfiltrate sensitive cloud credentials or compromise CI/CD environments. Reproduction: > Please see the attached poc_ssrf_and_path_traversal.py and terminal_output.t
compliance-trestle
source listed< 3.12.2
A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. **Finding 1 (Critical): SSRF (CWE-918)** The HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints (e.g., 169.254.169.254). Per rule 4.2.11 of the CVE CNA rules Finding 1 will be addressed in this advisory, while findings 2 & 3 will be addressed in separate advisories: --- Multiple Path Traversal Vulnerabilities in Remote Fetching Subsystem **Finding 2 & 3 (High/Medium): Path Traversal (CWE-22)** The caching logic for HTTPSFetcher and LocalFetcher fails to sanitize URI paths, allowing for arbitrary file reads via file:// or writing cached files outside the intended directory. Impact: > These vulnerabilities can be chained to exfiltrate sensitive cloud credentials or compromise CI/CD environments. Reproduction: > Please see the attached poc_ssrf_and_path_traversal.py and terminal_output.t
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. FIRST EPSS
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-w76h-q7c6-jpjp ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
- CVE-2026-46380 ↗
FIRST EPSS · official catalog
Observed . FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 2 ·
Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.