CVE-2026-47661 in Pathling
Summary
by MITRE • 08/07/2026
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified in Pathling Server versions prior to 200 represents a critical path traversal flaw that undermines the security boundaries of the asynchronous export functionality. This weakness occurs within the `/$result` endpoint where the system fails to properly validate and sanitize user-supplied file paths, allowing malicious actors to exploit valid async export job IDs to access arbitrary files within the underlying filesystem. The flaw stems from inadequate input validation and path normalization mechanisms that permit attackers to craft file parameter values containing traversal sequences such as "../" or similar constructs. The vulnerability is particularly severe because it operates at the filesystem level rather than merely affecting application logic, creating a direct pathway for unauthorized data access.
The technical implementation of this vulnerability exposes fundamental security architecture issues within the Pathling Server's asynchronous export system. When a user provides a valid job ID along with a crafted file parameter, the system validates the job ID but fails to constrain the file path to the specific job's designated scratch space directory. This allows the attacker to traverse up from the intended job directory to access other files within the same warehouse database root that contains both temporary export data and persisted resource tables. The lack of proper path normalization and confinement means that even legitimate users with valid job IDs can potentially access sensitive data belonging to other users or system components. This issue directly maps to CWE-23, which describes improper limitation of a pathname to a restricted directory, and represents a classic example of insufficient input validation in file system operations.
The operational impact of this vulnerability extends far beyond simple information disclosure, as it provides attackers with the capability to read arbitrary files from the server's filesystem. Since the async export scratch space shares the same database root as persisted resource tables, attackers can potentially access sensitive clinical data, configuration files, or other system resources that should remain isolated from unauthorized access. This creates a significant risk for healthcare organizations where patient data protection is paramount under regulations such as HIPAA and GDPR. The vulnerability affects not just individual user data but could potentially expose entire datasets if the attacker can identify and access other job directories or system files. Attackers with knowledge of valid job IDs can systematically enumerate and access resources that should be protected by proper access controls, effectively bypassing the intended security boundaries.
Mitigation strategies for this vulnerability require both immediate operational fixes and architectural improvements to prevent similar issues in the future. The primary fix implemented in Pathling Server 200 involves proper path normalization and confinement of file operations to prevent traversal outside designated job directories. As a temporary measure, administrators should disable async export operations entirely by setting `pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, and `bulkSubmitEnabled` to false values. Alternatively, organizations can implement authentication mechanisms and restrict export capabilities to trusted callers only, thereby limiting the attack surface while maintaining operational functionality. This approach aligns with ATT&CK technique T1078 which covers valid accounts and privilege escalation, as the vulnerability essentially allows unauthorized access through legitimate job IDs. The fix demonstrates the importance of proper input validation and least privilege principles in security architecture design, particularly when dealing with file system operations and temporary data handling in healthcare applications where data sensitivity requires robust protection mechanisms.