Compliance‑trestle’s profile import mechanism, used before versions 3.12.2 and 4.0.3, resolves `trestle://` URIs and relative file paths by appending them to the trestle_root directory and calling `.resolve()`. It performs no boundary check to keep the resolved path inside the trestle workspace. This omission allows an attacker who supplies a malicious OSCAL profile YAML containing path‑traversal sequences in `imports[].href` to read arbitrary files from the server filesystem. The vulnerability (CWE‑22) exposes sensitive files or credentials, compromising confidentiality. The issue has been fixed in versions 3.12.3 and 4.0.3.

The vulnerability applies to oscal‑compass compliance‑trestle library in versions 3.12.2 or earlier and 4.0.3 or earlier. Any installation that has not been updated to 3.12.3 or a newer release lacks the fix that validates import paths against the trestle workspace.

This flaw carries a CVSS score of 6.9, indicating a medium severity. The EPSS score is 0.00371, indicating a very low but non-zero likelihood of exploitation, and it is not listed in the CISA KEV catalog. An attacker who can trigger the profile import—by uploading a malicious OSCAL file through the tool’s interface or API—could read any file accessible to the process. The confidentiality impact is significant, while other impacts like remote code execution are not implied.