oscal-compass compliance-trestle up to 3.12.1/4.0.2 Remote Fetching Cache Mechanism path traversal

Summaryinfo

A vulnerability, which was classified as problematic, has been found in oscal-compass compliance-trestle up to 3.12.1/4.0.2. Affected is an unknown function of the component Remote Fetching Cache Mechanism. Performing a manipulation results in path traversal. This vulnerability is reported as CVE-2026-45725. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in oscal-compass compliance-trestle up to 3.12.1/4.0.2. This affects an unknown functionality of the component Remote Fetching Cache Mechanism. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on integrity, and availability. The summary by CVE is:

compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-45725 since 05/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 3.12.2 or 4.0.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• oscal-compass

Name

• compliance-trestle

Version

• 3.12.0
• 3.12.1
• 4.0.0
• 4.0.1
• 4.0.2

Website

• Product: https://github.com/oscal-compass/compliance-trestle/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion