CVE-2026-47659
Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}
Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. The `$result` handler now resolves and canonicalizes the requested file path and rejects any request that escapes the job's `jobs/<jobId>` directory. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers.
INFO
Published Date :
Aug. 7, 2026, 8:16 p.m.
Last Modified :
Oct. 23, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Pathling Server to version 2.0.0.
- Disable async export operations if updating is not possible.
- Enable authentication and restrict export access.
- Restrict export capabilities to trusted callers.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-47659.
| URL | Resource |
|---|---|
| https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq | |
| https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-47659 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-47659
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-47659 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-47659 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: pathling de aehrc, Description: Pathling es un conjunto de herramientas que facilitan el uso de FHIR y la terminología clínica en el análisis de datos de salud. Antes de la versión 2.0.0 de Pathling Server, el punto final ’/$result’ de Pathling permite a un llamador que puede obtener cualquier ID de trabajo de exportación asíncrona válido proporcionar valores de parámetro ’file’ que contengan secuencias de salto de ruta. El gestor verifica solo el ’job’ proporcionado y nunca normaliza ni confina la ruta del ’file’ solicitada al directorio ’jobs/[jobId]’ de ese trabajo antes de abrirlo como un recurso del sistema de archivos. Debido a que el espacio de trabajo temporal de exportación asíncrona reside bajo la misma raíz de la base de datos del almacén que las tablas de recursos persistentes, un atacante puede usar su propio trabajo de exportación para leer otros archivos del almacén. Esto se soluciona en Pathling Server 2.0.0. El gestor ’$result’ ahora resuelve y canoniza la ruta del archivo solicitada y rechaza cualquier solicitud que escape del directorio ’jobs/[jobId]’ del trabajo. Como mitigación provisional, deshabilite las operaciones de exportación asíncrona (’pathling.operations.exportEnabled’, ’patientExportEnabled’, ’groupExportEnabled’, ’bulkSubmitEnabled’) o habilite la autenticación y restrinja la capacidad de exportación a llamadores de confianza. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 10, 2026
Action Type Old Value New Value Added Reference https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq Added SSVC {'id': 'CVE-2026-47659', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-10T13:28:37.926684Z'} -
New CVE Received by [email protected]
Aug. 07, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'aehrc', 'product': 'pathling', 'versions': [{'status': 'affected', 'version': '< 2.0.0'}]}] Added Description Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. The `$result` handler now resolves and canonicalizes the requested file path and rejects any request that escapes the job's `jobs/<jobId>` directory. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-22 Added CWE CWE-918 Added Reference https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq