Pathway CVE-2026-59094

Exploitation requires that the Pathway document store's HTTP API - specifically the /v1/retrieve, /v1/inputs or /v2/answer endpoints - is network-reachable by the attacker; no authentication is needed (PR:N) and the endpoints accept an attacker-controlled filepath_globpattern in the request body with no length or -count limit. The concrete trigger is a short glob pattern containing many tokens, which forces exponential recursion in the hand-written matcher run once per indexed document. Limiting factors: only deployments that actually expose these document store endpoints (and index documents against which the pattern runs) are affected, and impact is confined to availability/CPU exhaustion - there is no data disclosure or code execution. Effectiveness scales with the number of indexed documents, so larger stores amplify the DoS.

This is a genuine, easily-triggered availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and impact is scoped purely to availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity loss despite the 'Information Disclosure' tag in the input, which appears mislabeled and should be treated as DoS. Publicly available exploit code raises real-world exploit likelihood, though the CVE is not in CISA KEV and no EPSS score was provided, so active mass exploitation is not confirmed - treat POC availability and active exploitation as distinct signals. The primary limiting factor is that only deployments exposing the document store HTTP endpoints to untrusted networks are at risk; the low complexity and lack of authentication make it a legitimate patch priority for any internet- or multi-tenant-facing Pathway deployment.

An attacker who can reach an exposed Pathway document store sends a small POST to /v1/retrieve (or /v1/inputs or /v2/answer) whose body sets filepath_globpattern to a short string containing many ** tokens. The custom recursive matcher evaluates this pattern against every indexed document, burning tens of seconds of CPU per request; a few concurrent requests saturate the workers and deny service to legitimate users. Public exploit code for this technique is available, and no authentication or user interaction is required.