Path Traversal Vulnerability in Compliance-Trestle by OSCAL Compass
CVE-2026-45725
7.1HIGH
What is CVE-2026-45725?
The compliance-trestle tooling platform, designed to manage compliance as code, contains a vulnerability in its remote fetching cache mechanism. Prior to versions 3.12.2 and 4.0.3, an unsafe caching implementation allows attackers to exploit path traversal sequences (../) when fetching OSCAL profiles via URLs. This leads to arbitrary file writes on the filesystem, as fetched content can be written outside the prescribed cache directory. Users of the affected versions should upgrade to 3.12.3 or 4.0.3, which address this issue.
Affected Version(s)
compliance-trestle < 3.12.2 < 3.12.2
compliance-trestle >= 4.0.0, < 4.0.3 < 4.0.0, 4.0.3