CVE-2026-45774
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the profile import mechanism that allows reading arbitrary files from the server filesystem. The mechanism joins `trestle://` URIs and relative paths with `trestle_root` without boundary checks, enabling an attacker to use path traversal sequences in `imports[].href` in a malicious OSCAL profile.
Risk Assessment
An attacker can read sensitive files from the server, such as configurations, keys, or user data, compromising confidentiality and potentially enabling further attacks.
Recommendation
Upgrade compliance-trestle to version 3.12.3 or 4.0.3, which contain the fix.
Original NVD description (English source)
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Versions 3.12.3 and 4.0.3 patch the issue.