CVE-2026-45774: 
Python vulnerability analysis and mitigation

CVE-2026-45774 is a path traversal vulnerability (CWE-22) in the compliance-trestle Python library's profile import mechanism, enabling arbitrary file read from the server filesystem. It affects compliance-trestle versions >= 4.0.0 through <= 4.0.2 and all versions < 3.12.2. The vulnerability was published on May 27, 2026, and patched versions (4.0.3 and 3.12.2) were released the same day. It carries a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Security Advisory).

The root cause (CWE-22) lies in trestle/core/remote/cache.py within the LocalFetcher class, which resolves trestle:// URIs and relative file paths by joining them with trestle_root and calling Python's .resolve(), but performs no subsequent boundary check to confirm the resolved path remains within the trestle workspace. Three confirmed attack vectors exist: (PT-001) trestle://../../etc/passwd via the trestle:// URI scheme; (PT-002) ../../etc/passwd via a bare relative path in imports[].href; and (PT-003) traversal paths embedded in back_matter rlinks, which are passed directly to FetcherFactory.get_fetcher() at _import.py:104. Notably, TRESTLE_HREF_REGEX was defined at const.py:253 as dead code — path validation was intended but never implemented, and even if enforced, the regex ^trestle://[^/] would still pass traversal payloads since . matches [^/]. Exploitation requires the victim to import or resolve an attacker-controlled OSCAL profile YAML (GitHub Advisory, Security Advisory).

Successful exploitation allows an attacker to read arbitrary files from the server filesystem with the privileges of the process running compliance-trestle, with no impact on integrity or availability. High-value targets include credential files (/root/.aws/credentials, /root/.ssh/id_rsa), system files (/etc/passwd, /etc/shadow), and environment variables (/proc/self/environ). A particularly dangerous supply chain scenario exists: an attacker could publish a malicious OSCAL profile to a public compliance catalog, causing any organization that imports it to silently leak server files during profile resolution (GitHub Advisory, Security Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating direct exploitation via a crafted OSCAL profile YAML and direct LocalFetcher instantiation. The exploit requires no privileges and no authentication, but does require active user interaction — a victim must import or resolve the attacker-controlled OSCAL profile. The CVE status is currently "Reserved" and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time. The Feedly threat intelligence data indicates exploit maturity is rated "POC" (GitHub Advisory, Security Advisory).

1. Craft malicious OSCAL profile: Create a YAML file with a traversal payload in the imports[].href field, e.g.:

profile:
  uuid: "550e8400-e29b-41d4-a716-446655440000"
  metadata:
    title: "Malicious Profile"
    version: "1.0"
    last-modified: "2024-01-01T00:00:00+00:00"
    oscal-version: "1.0.4"
  imports:
    - href: "trestle://../../../../../../etc/passwd"

2. Deliver the profile to the victim: Distribute the malicious YAML via a public compliance catalog, shared repository, email, or any channel where the victim would import OSCAL profiles into their trestle workspace.
3. Trigger profile resolution: The victim runs a trestle command that resolves the profile (e.g., trestle author profile-resolve), causing LocalFetcher to be instantiated with the malicious href value.
4. Path traversal executes: LocalFetcher.__init__() computes Path(trestle_root / '../../../../../../etc/passwd').resolve() = /etc/passwd with no boundary check, and the file content is read and processed.
5. Exfiltrate data: The resolved file content (e.g., /etc/passwd, AWS credentials, SSH private keys) is returned to the attacker via the profile resolution output or error messages, or captured through a secondary channel if the attacker controls the catalog endpoint (GitHub Advisory, Security Advisory).

• File System: Unexpected access to sensitive files such as /etc/passwd, /etc/shadow, /root/.aws/credentials, /root/.ssh/id_rsa, or /proc/self/environ by the trestle process.
• Logs: Application or audit logs showing trestle resolving href values containing ../ sequences or trestle:// URIs with path traversal patterns; file access logs (e.g., auditd) recording reads of sensitive system files by the Python/trestle process.
• Network: Outbound connections from the trestle host to unexpected external domains immediately following profile import operations, which may indicate exfiltration of read file contents.
• Process: Python process (trestle) opening file descriptors to paths outside the designated trestle workspace directory, observable via lsof or auditd syscall monitoring (GitHub Advisory).

Upgrade compliance-trestle to version 4.0.3 (for the v4.x branch) or 3.12.2 (for the v3.x branch), which introduce a PathSecurityValidator class implementing multi-layer path traversal prevention: (1) blocking .. sequences in trestle:// URI paths before resolution, (2) enforcing workspace boundary checks via is_relative_to() after .resolve(), and (3) blocking access to sensitive system files even when outside-workspace access is permitted. The fix also adds SSRF protections for remote fetchers. If immediate upgrade is not possible, avoid importing OSCAL profiles from untrusted or unverified sources as a temporary workaround (Patch Commit, GitHub Advisory).