Is CVE-2026-45774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45774 being exploited in the wild.

How severe is CVE-2026-45774?

Medium severity, with a CVSS score of 4, published 13 August 2026.

Which products and versions are affected?

compliance-trestle (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.2,introduced=4.0.0,fixed=4.0.3, ECOSYSTEM:introduced=4.0.0,fixed=4.0.3.

Is there a fix for CVE-2026-45774?

Yes. compliance-trestle (PyPI): upgrade to 4.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45774 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45774?

Check whether you run compliance-trestle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45774: IBM compliance-trestle path traversal in profile import

CVE-2026-45774 · Severity: medium · CVSS 4 · Published 2026-08-13

IBM compliance-trestle is a library used to manage and automate compliance documentation. A security flaw in how it handles file imports allows an attacker to trick the system into reading sensitive files from the server, such as passwords or private keys. This occurs when a user is persuaded to import a specially crafted compliance profile.

Technologies: compliance-trestle (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-45774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45774 being exploited in the wild.
How severe is CVE-2026-45774?: Medium severity, with a CVSS score of 4, published 13 August 2026.
Which products and versions are affected?: compliance-trestle (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.2,introduced=4.0.0,fixed=4.0.3, ECOSYSTEM:introduced=4.0.0,fixed=4.0.3.
Is there a fix for CVE-2026-45774?: Yes. compliance-trestle (PyPI): upgrade to 4.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45774 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45774?: Check whether you run compliance-trestle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

compliance-trestle (PyPI): upgrade to 4.0.3 or later
```
pip install "compliance-trestle>=4.0.3"
```

Technical details

A path traversal vulnerability exists in the profile import mechanism of compliance-trestle. The `LocalFetcher` class in `trestle/core/remote/cache.py` resolves `trestle://` URIs and relative paths using `pathlib.Path.resolve()` without verifying that the resulting path remains within the intended workspace boundary. An attacker can exploit this by providing a malicious OSCAL profile YAML containing traversal sequences (e.g., `../../`) in the `imports[].href` field. If a victim imports this profile, the attacker can read arbitrary files from the server's filesystem. The issue is fixed in versions 4.0.3 and 3.12.2 by implementing boundary checks using `is_relative_to()`.

Affected products

IBM compliance-trestle >= 4.0.0, <= 4.0.2
IBM compliance-trestle < 3.12.2

Identifiers

CVE-2026-45774
GHSA-mj4x-vf5c-5xg8
PYSEC-2026-2426

Timeline

2026-04-30: other: Vulnerability confirmed in v4.0.2
2026-05-27: patched: Fixes released in versions 4.0.3 and 3.12.2
2026-05-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.