The vulnerability lies in the way the compliance‑trestle fetching library builds its cache file path from the URL component without sanitizing path traversal characters. When a remote OSCAL profile contains a URL that includes sequences like "../", the HTTP or SFTP response body is written to an unintended location outside the cache directory. This allows an attacker who can supply a malicious OSCAL profile to cause the tool to create or overwrite arbitrary files on the local filesystem, potentially leading to code execution or privilege escalation. The weakness is defined as CWE‑73, a path traversal flaw that compromises confidentiality, integrity, and availability of the host system.

The affected product is compliance‑trestle from the oscal‑compass vendor. Versions prior to 3.12.2 (for the 3.x series) and prior to 4.0.3 (for the 4.x series) are vulnerable. The patched releases are 3.12.3 and 4.0.3, which include proper sanitization of path traversal characters in the cache path.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, but the absence of listing in the CISA KEV catalog suggests no known widespread exploitation yet. The likely attack vector involves an attacker providing a crafted OSCAL profile URL, which the tool will fetch and cache. If the attacker can influence the profile retrieval step, they may trigger the arbitrary file write. The exploit requires the tool to run with sufficient permissions to write to the filesystem, which is often granted in environments where compliance‑trestle is executed.