compliance-trestle versions before 3.12.2 and 4.0.3 contain a path traversal vulnerability (CWE-22) in the handling of the `-o/--output` argument of the `trestle author jinja` command. The application fails to properly validate relative path components such as `../` or `..\` and absolute paths, enabling an attacker to write files outside the designated workspace directory. This improper limitation of pathname allows arbitrary file write to locations controlled by the attacker. The vulnerability is addressed in versions 3.12.2 and 4.0.3.

Successful exploitation allows an attacker to write arbitrary files to locations outside the intended workspace, potentially leading to system compromise, data corruption, or privilege escalation depending on the environment and file system permissions. The CVSS score of 8.4 (high) reflects the significant confidentiality, integrity, and availability impacts.

Upgrade compliance-trestle to version 3.12.2 or later, or 4.0.3 or later, where this path traversal vulnerability has been fixed. No other mitigations are specified. Patch status is confirmed by the version information in the advisory.