Cloudanix VulnDB

CVE-2026-45725

Medium · 6.5

compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

CVSS

6.5

EPSS

0.5%

Published

May 27, 2026

CISA due date

—

The record

The compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location **outside the intended cache directory**, enabling **arbitrary file write with attacker-controlled content** to the filesystem. **Attack chain:** Malicious OSCAL profile → HTTPS fetch → cache path traversal → arbitrary file write → RCE (via cron, SSH keys, etc.)

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities