CVE-2026-59094

Name of the Vulnerable Software and Affected Versions Pathway versions prior to 0.31.1

Description The document store uses a hand-written recursive matcher to apply caller-supplied glob patterns to indexed document paths. Because the matcher branches two ways on each ** token without memoization, it results in exponential worst-case complexity. A remote unauthenticated attacker can exploit this by submitting a short pattern containing numerous ** tokens via the body of the unauthenticated HTTP endpoints '/v1/retrieve', '/v1/inputs', and '/v2/answer'. The filepath globpattern value is compiled into a filter evaluated for every indexed document without length or token limits, allowing an attacker to consume CPU resources and cause a denial of service.

Recommendations Update Pathway to a version that includes the fix implemented in commit d09722e. Avoid using the filepath globpattern parameter in the '/v1/retrieve', '/v1/inputs', and '/v2/answer' endpoints until the update is applied.