CVE-2026-45774

Received Received - Intake

Path Traversal in Compliance-Trestle

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Versions 3.12.3 and 4.0.3 patch the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-45774

Affected Vendors & Products

Vendor	Product	Version / Range
oscal-compass	compliance-trestle	to 3.12.2 (inc)
oscal-compass	compliance-trestle	to 4.0.3 (inc)
oscal-compass	compliance-trestle	From 0.0.2 (inc) to 4.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the compliance-trestle library's profile import mechanism. It allows attackers to craft malicious OSCAL profile YAML files with path traversal sequences in the imports[].href field. When processed, the library resolves these paths without proper boundary checks, enabling file reads outside the intended workspace.

Detection Guidance

Check for compliance-trestle versions below 3.12.2 or 4.0.3 using pip show compliance-trestle. Inspect OSCAL profile YAML files for imports[].href containing path traversal sequences like ../../../../../../etc/passwd. Review logs for unauthorized file access attempts or suspicious URI resolutions.

Impact Analysis

An attacker could exploit this to read sensitive files from the server filesystem, such as /etc/passwd, SSH keys, AWS credentials, or other configuration files. This could lead to credential theft, system reconnaissance, or supply chain attacks if malicious profiles are imported.

Mitigation Strategies

Upgrade compliance-trestle to versions 3.12.3 or 4.0.3 or later. Validate all imported OSCAL profiles for path traversal sequences in href attributes. Configure environment variables like TRESTLE_BLOCK_PRIVATE_IPS to block private IP access. Monitor logs for unauthorized file access attempts.

Hi! I’m here to help you understand CVE-2026-45774. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70