CVE-2026-45725 oscal-compass CVE debrief

Who should care

Defenders responsible for managing compliance as code using the compliance-trestle tooling platform should assess exposure to this vulnerability and apply patches or mitigations as needed.

Why it matters

CVE-2026-45725 is a high-severity vulnerability in compliance-trestle that allows for arbitrary file writes. Defenders should assess exposure and apply patches or mitigations to prevent potential exploitation.

• Potential arbitrary file writes with attacker-controlled content.
• Possible exploitation requires verification from official sources.
• Defenders should verify exposure and apply patches or mitigations.

Technical summary

The compliance-trestle library's remote fetching cache mechanism constructs local cache file paths from URL path components without sanitizing path traversal sequences. This allows for arbitrary file writes with attacker-controlled content to the filesystem. The issue was patched in versions 3.12.3 and 4.0.3. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential arbitrary file writes. The vulnerability has a CVSS score of 7.1 and is considered high-severity. Affected product context and defensive impact should be considered when assessing exposure.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential arbitrary file writes.

Recommended defensive actions

• Verify if the compliance-trestle tooling platform is in use and assess exposure to the vulnerability.
• Apply patches or mitigations to prevent potential arbitrary file writes.
• Monitor for potential suspicious activity related to the vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and patched versions. However, additional information on potential exploitation or impact is limited. Defenders should verify exposure and apply patches or mitigations to prevent potential exploitation. The compliance-trestle library's remote fetching cache mechanism constructs local cache file paths from URL path components without sanitizing path traversal sequences.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.