High [CVE-2026-45725] Arbitrary file write via path traversal in remote fetching mechanism

compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`).

When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. This enables arbitrary file write with attacker-controlled content, leading to potential system compromise.

An attacker could exploit this by providing a malicious URL within an OSCAL profile, leading to the writing of attacker-controlled content to arbitrary locations on the filesystem. This poses a significant risk to the integrity of the system where the File Integrity Operator is deployed.

Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N). Weakness: CWE-22.

Affected Red Hat products: File Integrity Operator. Red Hat lists Red Hat Hardened Images as not affected.

Red Hat does not currently list a fixing RHSA for this CVE.