CyberRota Analysis
AI-GeneratedThe compliance-trestle library is vulnerable due to its profile import mechanism, which allows for path traversal attacks by improperly resolving `trestle://` URIs and relative file paths. This flaw enables an attacker to craft a malicious OSCAL profile YAML that can read arbitrary files from the server's filesystem, potentially exposing sensitive information. Organizations using versions prior to 3.12.3 and 4.0.3 should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Versions 3.12.3 and 4.0.3 patch the issue.