Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| oscal-compass | compliance-trestle | affected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Oscal-compass | Compliance-trestle | 100% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-mj4x-vf5c-5xg8 | compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal |
Fri, 14 Aug 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Versions 3.12.3 and 4.0.3 patch the issue. | compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Versions 3.12.3 and 4.0.3 patch the issue. |
Fri, 14 Aug 2026 10:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Oscal-compass
Oscal-compass compliance-trestle |
|
| Vendors & Products |
Oscal-compass
Oscal-compass compliance-trestle |
Thu, 13 Aug 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Versions 3.12.3 and 4.0.3 patch the issue. | |
| Title | compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal | |
| Weaknesses | CWE-22 | |
| References |
|
|
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-08-14T17:04:38.615Z
Reserved: 2026-05-13T07:45:21.251Z
Link: CVE-2026-45774
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-13T20:17:22.173
Modified: 2026-08-14T18:17:26.900
Link: CVE-2026-45774
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-14T18:00:12Z