compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Date: 2026-05
Affected: pip/compliance-trestle, pip/compliance-trestle
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-45725
CWE: CWE-73

## Summary The compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location **outside the intended cache directory**, enabling **arbitrary file write with attacker-controlled content** to the filesystem. **Attack chain:** Malicious OSCAL profile → HTTPS fetch → cache path traversal → arbitrary file write → RCE (via cron, SSH keys, etc.) ## Affected Component **Repository:** https://github.com/IBM/compliance-trestle **File:** `trestle/core/remote/cache.py` (lines 259-266 for HTTPSFetcher, lines 328-333 for SFTPFetcher) **Version:** v4.0.2 (latest as of 2026-04-30) ## Vulnerable Code ### cache.py:259-266 — HTTPSFetcher cache path construction ```python class HTTPSFetcher(FetcherBase): def __init__(self, trestle_root: pathlib.Path, uri: str) -> None: # ... u = parse.urlparse(self._uri) # ... if u.hostname is None: raise TrestleError(f'Cache request for {self._uri} requires hostname') https_cached_dir = self._trestle_cache_path / u.hostname # ❌ path_parent preserves ../ sequences from URL path_parent = pathlib.Path(u.path[re.search('[^/\\\\]', u.path).span()[0] :]).parent https_cached_dir = https_cached_dir / path_parent h


Mitigations:

Architectural layers (MAESTRO):