CVE-2026-47659 in Pathling
Summary
by MITRE • 08/07/2026
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. The `$result` handler now resolves and canonicalizes the requested file path and rejects any request that escapes the job's `jobs/<jobId>` directory. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The Pathling Server vulnerability represents a critical path traversal flaw that undermines the security boundaries of clinical data processing systems. This issue affects versions prior to 2.0.0 where the `/$result` endpoint fails to properly validate file paths submitted by asynchronous export operations. The vulnerability stems from inadequate input sanitization and path resolution mechanisms within the server's file handling logic, creating an opportunity for unauthorized file access across the entire warehouse database root structure.
The technical implementation of this flaw occurs through the asynchronous export job system where valid job IDs can be obtained by any authenticated user with appropriate permissions to initiate exports. When attackers supply malicious file parameter values containing path traversal sequences such as "../", they can bypass normal directory restrictions and access files outside the intended job-specific scratch space. This vulnerability is classified as a CWE-22 Path Traversal attack, where the system fails to properly canonicalize or normalize file paths before accessing filesystem resources. The flaw specifically manifests in the lack of proper path confinement checks that should restrict all file operations to the designated `jobs/<jobId>` directory structure.
The operational impact of this vulnerability extends beyond simple unauthorized file access to represent a significant data breach risk within healthcare environments. Attackers can leverage their own export jobs to read sensitive clinical data from other users' export operations, potentially accessing patient records, demographic information, and other protected health information stored in the shared warehouse database. This cross-contamination of export scratch spaces creates a persistent threat vector where attackers can systematically explore the entire data repository structure through legitimate export operations. The vulnerability directly violates security principles of least privilege and principle of least privilege enforcement, as it allows arbitrary file access within the system's filesystem hierarchy.
The fix implemented in Pathling Server 2.0.0 addresses this vulnerability through proper path canonicalization and validation mechanisms that ensure all requested file paths are resolved relative to and confined within the specific job directory structure. This remediation aligns with ATT&CK technique T1074.001 for Data Staged, as it prevents attackers from staging malicious data access patterns through legitimate system interfaces. The solution requires path resolution using canonical path functions that eliminate symbolic links and normalize directory traversal sequences, ensuring that all file operations remain within the designated job-specific sandboxed environment.
Organizational security teams can implement interim mitigations by disabling async export capabilities through configuration parameters including `pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, and `bulkSubmitEnabled`. This approach effectively eliminates the attack surface while maintaining system functionality for other operations. Additionally, implementing authentication controls and restricting export capabilities to trusted callers provides an additional layer of defense that aligns with security best practices outlined in NIST SP 800-53 control AC-3. These mitigations ensure that even if the vulnerability were to persist, unauthorized access would be prevented through proper access control enforcement and operational restrictions on potentially dangerous system features.