CVE-2026-47661 Details
Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers.
A path traversal vulnerability has been identified in Pathling Server versions prior to 2.0.0. The issue resides in the `/$result` endpoint, where the handler allows a caller to supply `file` parameter values with path traversal sequences. The vulnerability arises because the endpoint only verifies the provided job ID and fails to normalize or restrict the requested file path to the corresponding job's directory before accessing it as a filesystem resource. This flaw enables an attacker to use their own export job to read unauthorized files from the warehouse database, potentially including sensitive patient data.
Users should upgrade to Pathling Server 2.0.0 or later. As an interim mitigation, export operations can be disabled or authentication enabled to restrict export capability to trusted callers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aehrc/pathling/security/advisories/GHSA-8w85-f63v-3wh6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/aehrc/pathling/security/advisories/GHSA-8w85-f63v-3wh6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| au.csiro.pathling | <= 1.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |