CVE-2026-47661: Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path traversal sequences. The handler verifies only the supplied job and never normalises or confines the requested file path to that job's jobs/<jobId> directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. As an interim mitigation, disable the async export operations (pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, bulkSubmitEnabled) or enable authentication and restrict export capability to trusted callers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pathling Serverto a version that resolves this vulnerability.Fixed in 2.0.0 - Configuration
Disable async export operations in Pathling Server by setting pathling.operations.exportEnabled to disabled.
Pathling Server async export operations pathling.operations.exportEnabled = disabled - Configuration
Disable patient async export operations by setting pathling.operations.patientExportEnabled to disabled.
Pathling Server async export operations pathling.operations.patientExportEnabled = disabled - Configuration
Disable group async export operations by setting pathling.operations.groupExportEnabled to disabled.
Pathling Server async export operations pathling.operations.groupExportEnabled = disabled - Configuration
Disable bulk submit async export operations by setting pathling.operations.bulkSubmitEnabled to disabled.
Pathling Server async export operations pathling.operations.bulkSubmitEnabled = disabled - Configuration
As an interim mitigation, enable authentication and restrict export capability to trusted callers so only trusted clients can access export functionality and async export job IDs.
Pathling Server export access control authentication = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47661?
The severity of CVE-2026-47661 is rated at risk level 55.
How do I fix CVE-2026-47661?
To fix CVE-2026-47661, upgrade to Pathling Server version 2.0.0 or later.
What type of vulnerability is CVE-2026-47661?
CVE-2026-47661 is categorized as a Path Traversal vulnerability.
What can attackers do with CVE-2026-47661?
Attackers can exploit CVE-2026-47661 to read arbitrary files from the warehouse via the $result endpoint.
Which software is affected by CVE-2026-47661?
CVE-2026-47661 affects Pathling Server prior to version 2.0.0.