CVE-2026-47661

Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0

Description The /$result endpoint allows a caller with a valid async export job ID to provide file parameter values containing path traversal sequences. Path traversal is a technique used to access files and directories that are stored outside the web root folder. The handler verifies the job but does not normalize or confine the requested file path to the specific jobs/<jobId> directory before accessing it as a filesystem resource. Since the async export scratch space is located under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse.

Recommendations Update to version 2.0.0. Disable the async export operations pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, and bulkSubmitEnabled as a temporary mitigation. Enable authentication and restrict export capability to trusted callers.