The compliance-trestle library's HTTPSFetcher and SFTPFetcher components construct local cache file paths directly from the URL path without sanitizing path traversal sequences such as '../'. This lack of sanitization allows an attacker who controls a remote OSCAL profile URL to cause the HTTP response body to be written outside the designated cache directory, resulting in arbitrary file write on the local filesystem. This vulnerability is tracked as CWE-73 (External Control of File Name or Path). Versions 3.12.3 and 4.0.3 contain patches that address this issue by properly sanitizing the path components.

An attacker able to supply a malicious URL with path traversal sequences can cause arbitrary files to be written to the filesystem of the host running compliance-trestle. This can lead to unauthorized file modification or creation, potentially enabling further compromise depending on the environment and file write locations. The vulnerability has a CVSS 4.0 score of 7.1 (high severity), indicating significant impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity.

Upgrade compliance-trestle to version 3.12.3 or later, or 4.0.3 or later, where the vulnerability is patched. No other mitigations are indicated. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the version increments and description confirm the fix availability in these versions.