Bug 2515613 (CVE-2026-45725)

Summary: CVE-2026-45725 compliance-trestle: compliance-trestle: Arbitrary file write via path traversal in remote fetching mechanism
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akoudelk, lbragsta, wenshen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in compliance-trestle. The library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) does not properly sanitize path traversal sequences (`../`) when constructing local cache file paths from URLs. A remote attacker can exploit this by referencing a malicious URL in an OSCAL profile, causing the HTTP response body to be written to an arbitrary location on the filesystem outside the intended cache directory. This enables arbitrary file write with attacker-controlled content, leading to potential system compromise.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-13 19:59:39 UTC 
compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.