The compliance-trestle library's profile import mechanism resolves 'trestle://' URIs and relative file paths by joining them with the 'trestle_root' directory and calling '.resolve()'. However, it lacks boundary checks to ensure the resolved path stays within the trestle workspace. An attacker can exploit this by crafting a malicious OSCAL profile YAML with 'imports[].href' containing path traversal sequences, enabling reading of arbitrary files on the server filesystem. This vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Versions prior to 3.12.3 and 4.0.3 are affected, with patches released in those versions.

An attacker can read arbitrary files on the server hosting compliance-trestle by exploiting the path traversal vulnerability in the profile import mechanism. This can lead to unauthorized disclosure of sensitive information stored on the server filesystem. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality.

Upgrade compliance-trestle to version 3.12.3 or later, or 4.0.3 or later, where this path traversal vulnerability has been patched. No other mitigation is indicated or required according to the available data.