A path traversal flaw in the Jinja templating command of compliance-trestle allows an attacker to write any file outside the intended workspace. The application accepts relative components such as "../", "..\\", or even absolute paths without validation, enabling arbitrary file overwrite. This vulnerability is categorized as CWE-22, CWE-36, and CWE-73 and carries a CVSS score of 8.4, indicating high severity. The ability to write to arbitrary locations can compromise system integrity, allowing attackers to inject malicious files, alter configuration, or place backdoors.

The flaw affects the compliance-trestle tool released by oscal‑compass. Versions older than 3.12.2 and 4.0.3 are vulnerable; the issue was patched in 3.12.3 and 4.0.3. All deployments using the affected command line interface are impacted.

The CVSS score of 8.4 denotes significant risk, yet the EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. The exploit is likely achievable by any user who can run trestle with a crafted output path. Based on the description, it is inferred that if the tool operates with elevated privileges, the arbitrary file write could lead to privilege escalation.