Which versions of Pathling Server are affected by CVE-2026-47659?

Pathling Server versions prior to 2.0.0 deployed without authentication expose a path traversal vulnerability enabling unauthorized access to protected health information stored in FHIR resource…. A patch is available.

How to fix or mitigate CVE-2026-47659?

Within 24 hours, inventory all Pathling Server instances to identify versions prior to 2.0.0 running without authentication and document exposure scope. Within 7 days, enable authentication on all Pathling Server instances if supported in your version, restrict network access to the /$result endpoint via firewall or WAF to essential systems only, and enable comprehensive logging of export endpoint activity. Within 30 days, establish contact with your vendor on the Pathling Server 2.0.0 release timeline and schedule upgrade planning, audit export access logs for evidence of unauthorized activity, and configure filesystem permissions to segregate FHIR resource storage from export working directories.

Pathling Server CVE-2026-47659

Q: What is the CVSS score of CVE-2026-47659?

CVE-2026-47659 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54640 HIGH

Path Traversal (CWE-22)

2026-08-07 security-advisories@github.com

Path Traversal

8.7

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network endpoint, no auth in default config per vendor mitigation framing; read-only impact means I:N/A:N; no scope change as access stays within the same server's filesystem.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 07, 2026 - 21:02 EUVD

Analysis Generated

Aug 07, 2026 - 20:31 vuln.today

CVE Published

Aug 07, 2026 - 20:16 cve.org

HIGH 8.7

DescriptionCVE.org

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path traversal sequences. The handler verifies only the supplied job and never normalises or confines the requested file path to that job's jobs/<jobId> directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. The $result handler now resolves and canonicalizes the requested file path and rejects any request that escapes the job's jobs/<jobId> directory. As an interim mitigation, disable the async export operations (pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, bulkSubmitEnabled) or enable authentication and restrict export capability to trusted callers.

AnalysisAI

Path traversal in Pathling Server's FHIR async export /$result endpoint exposes arbitrary warehouse filesystem files to any caller who can supply a valid export job ID. All Pathling Server deployments prior to version 2.0.0 running without authentication and with async export enabled are affected, as the file handler accepts user-supplied path components without normalization or directory confinement. No public exploit code has been identified at time of analysis, but the technique is straightforward - the attacker need only initiate their own export job to obtain a valid job ID, then traverse out of the job directory to reach co-located FHIR resource tables, which may contain protected health information.

Technical ContextAI

Pathling is a FHIR (Fast Healthcare Interoperability Resources) analytics server implementing the FHIR Bulk Data Access specification. Its /$result endpoint serves files produced by asynchronous bulk export jobs. The root cause is CWE-22 (Path Traversal): the handler validates the job query parameter against existing job IDs but never normalizes or canonically resolves the file query parameter before opening it as a filesystem resource. Because async export scratch space (jobs/<jobId>/) resides under the same warehouse database root as persisted FHIR resource tables (e.g., Parquet or Delta files for Patient, Observation, Condition), a traversal sequence in file (e.g., ../../Patient/part-0000.parquet) escapes the intended sandbox. The fix in version 2.0.0 resolves and canonicalizes the path at request time, rejecting any path that does not remain within the expected jobs/<jobId> directory.

RemediationAI

Upgrade to Pathling Server 2.0.0, the vendor-confirmed patched release, which resolves the issue by canonicalizing file paths and enforcing directory confinement within jobs/<jobId> before opening any resource. The security advisory at https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq should be consulted for full upgrade guidance. If immediate upgrade is not feasible, two interim mitigations are available: (1) Disable all async export operations by setting pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, and bulkSubmitEnabled to false - this eliminates the attack surface entirely but also disables bulk export functionality for all consumers; (2) Enable authentication and restrict export permissions to explicitly trusted callers - this raises the bar from zero-credential exploitation to credential-holding exploitation, but does not eliminate the underlying flaw and should not be considered a permanent fix. Neither workaround substitutes for patching.