CVE-2026-47664

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.

• CWE-20
• CWE-345
• CWE-918

• https://github.com/aehrc/pathling/security/advisories/GHSA-69wc-hrxh-5528
• https://github.com/aehrc/pathling/security/advisories/GHSA-69wc-hrxh-5528

Published

Aug 7, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47659Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-4766The Easy Image Gallery plugin for WordPress is vulnerable to…6.4
• CVE-2026-47660Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47661Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47662Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47663Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47665Penpot is an open-source design and prototyping platform. In…8.7
• CVE-2026-47666Penpot is an open-source design and prototyping platform. In…7.6
• CVE-2026-47667CImg Library is a C++ library for image processing. Prior to…7.5
• CVE-2026-47668DbGate is cross-platform database manager. In versions 7.1.8…10
• CVE-2026-47669DbGate is cross-platform database manager. In versions 7.1.8…9.3
• CVE-2026-4767Missing authentication for critical function vulnerability i…9.8