CVE-2026-45725
Description
compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
How to fix
- compliance-trestle4.0.3, 3.12.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| compliance-trestlePyPI | 4.0.0 ≤ v < 4.0.3, v < 3.12.2 | 4.0.3, 3.12.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.