CVE-2026-47659

Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0

Description The /$result endpoint allows a caller with a valid async export job ID to provide file parameter values containing path traversal sequences. The handler verifies the job but fails to normalize or confine the requested file path to the specific jobs/<jobId> directory before accessing it as a filesystem resource. Since the async export scratch space is located under the same warehouse database root as persisted resource tables, an attacker can leverage their own export job to read other files from the warehouse.

Recommendations Update to version 2.0.0. Disable the async export operations pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, and bulkSubmitEnabled as a temporary mitigation. Enable authentication and restrict export capability to trusted callers.