PT-2026-69130 · Unknown · Pathling Server
CVE-2026-47659
·
Published
2026-08-07
·
Updated
2026-08-07
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Pathling Server versions prior to 2.0.0
Description
The
/$result endpoint allows a caller with a valid async export job ID to provide file parameter values containing path traversal sequences. The handler verifies the job but fails to normalize or confine the requested file path to the specific jobs/<jobId> directory before accessing it as a filesystem resource. Since the async export scratch space is located under the same warehouse database root as persisted resource tables, an attacker can leverage their own export job to read other files from the warehouse.Recommendations
Update to version 2.0.0.
Disable the async export operations
pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, and bulkSubmitEnabled as a temporary mitigation.
Enable authentication and restrict export capability to trusted callers.Exploit
Fix
Path traversal
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pathling Server