Cloudanix VulnDB

CVE-2026-45774

Medium · 6.5

compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

CVSS

6.5

EPSS

0.5%

Published

May 28, 2026

CISA due date

—

The record

The compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs **no boundary check** to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Three attack vectors confirmed: 1. **PT-001:** `trestle://../../etc/passwd` — via trestle:// URI scheme 2. **PT-002:** `../../etc/passwd` — via relative path in href 3. **PT-003:** back_matter rlinks with traversal paths **Preconditions:** Victim must import/resolve an attacker-controlled OSCAL profile YAML.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities