CVE-2026-47664

Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0

Description The $import-pnp operation accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, the system builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and reclassifies those staged files as trusted local file:// imports. This process bypasses the allowableSources allowlist that protects the ordinary $import operation.

Recommendations Update to version 2.0.0. Disable the $import-pnp operation by setting pathling.operations.importPnpEnabled=false. Do not configure PNP credentials.