CVE-2026-47664 Details
Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.
A vulnerability exists in Pathling Server in versions through 1.2.0 within the $import-pnp operation. This operation accepts a user-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without verifying its trustworthiness. When PNP credentials are set, Pathling creates a credentialed bulk-export client that targets the specified host, downloads selected files, and reclassifies them as trusted local file imports. This process bypasses the allowableSources allowlist that normally safeguards the $import operation, leading to potential exploitation.
Users should upgrade to Pathling Server version 2.0.0 or later. As a temporary measure, the $import-pnp operation can be disabled or PNP credentials can be left unconfigured.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aehrc/pathling/security/advisories/GHSA-69wc-hrxh-5528 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/aehrc/pathling/security/advisories/GHSA-69wc-hrxh-5528 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| au.csiro.pathling | <= 1.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |