CVE-2026-45725

Received Received - Intake

Path Traversal in Compliance-Trestle

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-45725

EUVD

EUVD-2026-58356

Affected Vendors & Products

Vendor	Product	Version / Range
oscal-compass	compliance-trestle	to 4.0.3 (exc)
oscal-compass	compliance-trestle	to 4.0.2 (inc)
oscal-compass	compliance-trestle	From 0.0.2 (inc) to 4.0.2 (inc)
oscal-compass	compliance-trestle	3.12.2
oscal-compass	compliance-trestle	4.0.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

CVE-2026-45725 is a path traversal vulnerability in the compliance-trestle library affecting versions before 3.12.2 and 4.0.3. The issue occurs in HTTPSFetcher and SFTPFetcher components where cache file paths are constructed from URL paths without sanitizing traversal sequences like '../'. Attackers can craft malicious URLs to write arbitrary files outside the intended cache directory, potentially leading to remote code execution.

Detection Guidance

Check if your compliance-trestle version is vulnerable by running: pip show compliance-trestle. If the version is <= 4.0.2 or <= 3.12.2, it is vulnerable. Inspect logs for unusual file writes outside cache directories, especially in /tmp, /etc, or ~/.ssh. Monitor for unexpected network requests to internal or sensitive endpoints.

Impact Analysis

This vulnerability allows attackers to write malicious files to arbitrary locations on your system. Potential impacts include remote code execution via cron jobs, SSH authorized keys injection, configuration file overwrites, or Python path hijacking. Attackers could gain control over your system by exploiting this flaw in the compliance-trestle library.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially exposing sensitive data or system configurations. For GDPR, it may result in unauthorized access to personal data. For HIPAA, it could compromise protected health information. Compliance violations may occur if attackers gain access to regulated data or system files.

Mitigation Strategies

Upgrade compliance-trestle to version 4.0.3 or later, or 3.12.3 or later immediately. If upgrading is not possible, restrict network access to compliance-trestle processes and monitor filesystem writes. Disable remote fetching if not required. Review and remove any suspicious files written outside cache directories.

Hi! I’m here to help you understand CVE-2026-45725. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70