CVE-2026-45725 in compliance-trestle
Summary
by MITRE • 08/13/2026
compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/13/2026
The compliance-trestle platform serves as a critical tool for managing compliance as code within organizational security frameworks, providing automated mechanisms for handling OSCAL (Open Security Controls Assessment Language) profiles and related compliance artifacts. This vulnerability affects versions prior to 3.12.2 and 4.0.3, where the software's remote fetching cache mechanism demonstrates a fundamental flaw in path validation and sanitization. The issue stems from how the HTTPSFetcher and SFTPFetcher components process URL paths when constructing local cache file locations, creating a path traversal vulnerability that can be exploited by malicious actors.
The technical flaw manifests in the absence of proper input sanitization for URL path components during cache file path construction. When these fetchers encounter remote URLs containing path traversal sequences such as `../`, they fail to sanitize or validate these components before using them to determine local file system locations. This allows an attacker to craft malicious OSCAL profile references that contain traversal sequences in their URL paths, causing the system to write HTTP response content to arbitrary locations outside the intended cache directory structure. The vulnerability operates at the intersection of improper input validation and insecure file handling practices.
The operational impact of this vulnerability is significant within compliance management environments where automated fetching of remote compliance artifacts is common. An attacker with control over a remote OSCAL profile or the ability to influence the content of a remote fetch operation can leverage this flaw to write arbitrary files to the filesystem with attacker-controlled content. This creates potential for privilege escalation, code execution, and system compromise when the cached files are subsequently processed by the compliance-trestle platform or when the written files are executed as part of automated workflows. The vulnerability particularly affects environments where compliance artifacts are fetched from untrusted sources without proper validation.
This vulnerability aligns with CWE-22 (Path Traversal) and represents a classic example of insecure direct object reference in a caching context. The ATT&CK framework categorizes this under TA0043 (Reconnaissance) and potentially TA0002 (Execution) depending on how the written files are subsequently processed, though it primarily functions as a pre-cursor to more serious exploitation vectors. The issue demonstrates how seemingly benign caching mechanisms can become attack surfaces when proper input validation is omitted. Organizations using compliance-trestle in production environments should immediately apply patches to versions 3.12.3 and 4.0.3, which implement proper path sanitization and validation for URL components during cache file path construction. The mitigation strategy involves ensuring that all path traversal sequences are stripped or encoded before being used in local file system operations, maintaining strict separation between remote content and local storage locations while preserving the intended functionality of the caching mechanism.