https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:55:41.416790+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-45774 CVE-2026-45774 — compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal 2026-10-07T00:55:41.432423+00:00

Affected: oscal-compass compliance-trestle

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. Versions 3.12.3 and 4.0.3 patch the issue.