CVE-2026-45725

The CVE-2026-45725 path traversal in compliance-trestle is a textbook file-write vulnerability that becomes something more serious in context. The tool fetches remote OSCAL profiles, extracts URL path components, and uses them directly as cache filenames without sanitization — an attacker controlling a remote profile can embed traversal sequences (`../../`) to write files anywhere the process has write access. What elevates this from a moderate file-write bug to a supply-chain concern is the blast radius. Compliance-trestle doesn't run in a sandbox — it operates in elevated CI/CD contexts with broad filesystem access and produces outputs that downstream systems trust for audit decisions. Arbitrary file write from that position means you can overwrite SSH authorized_keys, inject into bashrc, modify cron jobs, or plant artifacts that survive rebuilds. The CVSS 7.1 rating weights the technical mechanism without capturing that a compromised compliance pipeline is an attack vector into the most security-sensitive infrastructure an organization runs. The deeper issue is architectural. This tool was designed to fetch and trust remote content — that trust extended to URL construction for cache writes, despite no validation at the filesystem layer. The patch presumably adds path sanitization, but the underlying assumption — that peripheral systems inherit the core function's trust posture — remains unchallenged. Caches occupy a structural blind spot in security review precisely because they're treated as passive infrastructure, not active attack surface. What to do: verify your compliance-trestle version includes the patch for this traversal. Beyond that, audit your cache write paths in any tool that performs remote-to-local translation — the pattern recurs. Treat cache logic with the same adversarial scrutiny you apply to parsing logic. And question the design assumption: if a tool's core purpose is "fetch and trust remote content," does patching one traversal variant address the real risk, or just defer the next trust-boundary collapse?

Reviewed through automated stages and approved by a human before publication.