{"items":[{"id":"NVI-00018574","kind":"vulnerability","title":"compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g3vg-vx23-3858","CVE-2026-45725"],"plain_summary":"GitHub lists this reviewed advisory for compliance-trestle, compliance-trestle. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3ec96590d1eb29def8068db8b4e0a427"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3ec96590d1eb29def8068db8b4e0a427","url":"https://github.com/advisories/GHSA-g3vg-vx23-3858","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-g3vg-vx23-3858","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:53:22.747Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3ec96590d1eb29def8068db8b4e0a427"],"technology":"compliance-trestle","known_exclusions":[],"conditions_summary":"## Summary\n\nThe compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location **outside the intended cache directory**, enabling **arbitrary file write with attacker-controlled content** to the filesystem.\n\n**Attack chain:** Malicious OSCAL profile → HTTPS fetch → cache path traversal → arbitrary file write → RCE (via cron, SSH keys, etc.)\n\n## Affected Component\n\n**Repository:** https://github.com/IBM/compliance-trestle\n**File:** `trestle/core/remote/cache.py` (lines 259-266 for HTTPSFetcher, lines 328-333 for SFTPFetcher)\n**Version:** v4.0.2 (latest as of 2026-04-30)\n## Vulnerable Code\n\n### cache.py:259-266 — HTTPSFetcher cache path construction\n\n```python\nclass HTTPSFetcher(FetcherBase):\n    def __init__(self, trestle_root: pathlib.Path, uri: str) -> None:\n        # ...\n        u = parse.urlparse(self._uri)\n        # ...\n        if u.hostname is None:\n            raise TrestleError(f'Cache request for {self._uri} re","public_affected_ranges":[">= 4.0.0, <= 4.0.2"]},{"certainty":"source_listed","source_ids":["sr-3ec96590d1eb29def8068db8b4e0a427"],"technology":"compliance-trestle","known_exclusions":[],"conditions_summary":"## Summary\n\nThe compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location **outside the intended cache directory**, enabling **arbitrary file write with attacker-controlled content** to the filesystem.\n\n**Attack chain:** Malicious OSCAL profile → HTTPS fetch → cache path traversal → arbitrary file write → RCE (via cron, SSH keys, etc.)\n\n## Affected Component\n\n**Repository:** https://github.com/IBM/compliance-trestle\n**File:** `trestle/core/remote/cache.py` (lines 259-266 for HTTPSFetcher, lines 328-333 for SFTPFetcher)\n**Version:** v4.0.2 (latest as of 2026-04-30)\n## Vulnerable Code\n\n### cache.py:259-266 — HTTPSFetcher cache path construction\n\n```python\nclass HTTPSFetcher(FetcherBase):\n    def __init__(self, trestle_root: pathlib.Path, uri: str) -> None:\n        # ...\n        u = parse.urlparse(self._uri)\n        # ...\n        if u.hostname is None:\n            raise TrestleError(f'Cache request for {self._uri} re","public_affected_ranges":["< 3.12.2"]}],"null_published_at":"2026-11-07T07:07:39.857Z","source_updated_at":"2026-05-27T22:57:40.000Z","source_disclosed_at":"2026-05-27T22:57:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:53:22.747Z"}],"next_cursor":null,"snapshot_revision":"42594"}