CVE-2026-45725

Name of the Vulnerable Software and Affected Versions compliance-trestle version 4.0.2

Description The remote fetching cache mechanism in the HTTPSFetcher and SFTPFetcher classes fails to sanitize path traversal sequences (../) when constructing local cache file paths from URL path components. An attacker can provide a malicious OSCAL profile containing a URL with traversal sequences, causing the response body to be written to an arbitrary location on the filesystem outside the intended cache directory. This arbitrary file write can lead to Remote Code Execution (RCE) through methods such as injecting malicious cron jobs, adding SSH authorized keys, overwriting configuration files, or hijacking the Python path by writing malicious .py files to sys.path locations.

Recommendations For version 4.0.2, sanitize the URL path by removing traversal sequences and implement a boundary check using is relative to() to ensure the resolved path remains within the intended cache directory. As a temporary mitigation, restrict the use of the HTTPSFetcher and SFTPFetcher components when processing untrusted remote OSCAL profiles.