CVE-2026-47659

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. The `$result` handler now resolves and canonicalizes the requested file path and rejects any request that escapes the job's `jobs/<jobId>` directory. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers.

• CWE-22
• CWE-918

• https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq
• https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq

Published

Aug 7, 2026

Last Modified

Aug 10, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47652Heap-based buffer overflow in Windows Hyper-V allows an auth…8.2
• CVE-2026-47653Use after free in Remote Desktop Client allows an unauthoriz…8.8
• CVE-2026-47654Use after free in Remote Desktop Client allows an unauthoriz…7.5
• CVE-2026-47655Exposure of sensitive information to an unauthorized actor i…6.5
• CVE-2026-47656Protection mechanism failure in Windows Boot Manager allows …7.9
• CVE-2026-47657HumHub is an Open Source Enterprise Social Network. In versi…7.1
• CVE-2026-4766The Easy Image Gallery plugin for WordPress is vulnerable to…6.4
• CVE-2026-47660Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47661Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47662Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47663Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47664Pathling is a set of tools that make it easier to use FHIR a…8.6