CVE-2026-45774

Name of the Vulnerable Software and Affected Versions compliance-trestle versions prior to 3.12.3 compliance-trestle versions prior to 4.0.3

Description The profile import mechanism in the compliance-trestle library fails to perform boundary checks when resolving trestle:// URIs and relative file paths. By joining these paths with trestle root and calling .resolve(), the system allows the resolution of paths outside the intended trestle workspace. An attacker can exploit this by crafting a malicious OSCAL profile YAML file containing path traversal sequences in the imports[].href parameter to read arbitrary files from the server filesystem. This can be achieved through the trestle:// URI scheme, relative paths in the href, or via back matter rlinks. The issue is located within the LocalFetcher class in trestle/core/remote/cache.py and the Import class in trestle/core/resolver/ import.py.

Recommendations Update compliance-trestle to version 3.12.3 or later. Update compliance-trestle to version 4.0.3 or later. As a temporary mitigation, restrict the import of OSCAL profile YAML files from untrusted or attacker-controlled sources.