CVE-2026-47659: Pathling Server Path Traversal Flaw

CVE-2026-47659 Overview

CVE-2026-47659 is a path traversal vulnerability [CWE-22] in Pathling Server, a toolset for working with FHIR and clinical terminology in health data analytics. The flaw affects versions prior to 2.0.0. The /$result endpoint accepts a file parameter but never normalizes or confines the requested path to the job's jobs/<jobId> directory. An attacker with any valid async export job ID can supply path traversal sequences to read arbitrary files from the warehouse database root, including persisted resource tables.

Critical Impact
An unauthenticated network attacker who obtains a valid async export job ID can read sensitive warehouse files, including persisted FHIR resource tables containing protected health information.

Affected Products

Pathling Server versions prior to 2.0.0
Deployments exposing the /$result endpoint
Instances with async export operations enabled

Discovery Timeline

2026-08-07 - CVE-2026-47659 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-47659

Vulnerability Analysis

The vulnerability resides in the /$result endpoint handler of Pathling Server. This endpoint returns the output artifacts of asynchronous export jobs. The handler validates the job parameter, confirming the caller references a legitimate export job. However, it fails to apply the same rigor to the file parameter that identifies which artifact to return.

A caller can supply relative path segments such as ../ in the file value. The handler concatenates this input into a filesystem resource path and opens it directly. Because Pathling stores async export scratch data under the same warehouse database root as persisted resource tables, traversal sequences reach beyond the job directory into stored FHIR data.

The warehouse layout amplifies the impact. Persisted resource tables containing clinical data live adjacent to per-job export directories. An attacker who submits their own export job obtains a valid jobId, then reuses it as the authorization anchor for reading arbitrary warehouse files.

Root Cause

The root cause is missing path canonicalization and containment enforcement on the file parameter. The handler trusts client-supplied file identifiers without resolving them against a canonical base directory. There is no check that the resolved path remains within jobs/<jobId> before the file is opened as a resource.

Attack Vector

Exploitation occurs over the network against the Pathling Server HTTP interface. When authentication is disabled, any caller can submit a bulk or patient export request to obtain a valid jobId, then invoke /$result with a traversal payload in the file parameter. When authentication is enabled but export capability is broadly granted, any authorized caller can perform the same steps. No user interaction is required.

The vulnerability is described in prose per the GitHub Security Advisory GHSA-5h9r-m7r5-8jxq. No proof-of-concept exploit code has been published.

Detection Methods for CVE-2026-47659

Indicators of Compromise

HTTP requests to /$result containing .., %2e%2e, or URL-encoded traversal sequences in the file query parameter
Access log entries where the file parameter references paths outside the caller's jobs/<jobId> directory
Unexpected file-open operations on warehouse resource-table paths originating from the Pathling process
Anomalous volume of async export job submissions followed by immediate /$result calls

Detection Strategies

Deploy web application firewall rules that inspect the file parameter on /$result and block requests containing traversal metacharacters
Alert on process-level file access outside the expected jobs/ subtree when Pathling is the accessing process
Correlate export job creation events with subsequent $result retrievals that reference paths not matching the created jobId

Monitoring Recommendations

Enable verbose HTTP access logging on the Pathling Server and forward logs to a centralized analytics platform for retention
Monitor filesystem audit logs on the warehouse database root for reads issued by the Pathling service account
Track authentication configuration state to detect regressions that expose export operations to anonymous callers

How to Mitigate CVE-2026-47659

Immediate Actions Required

Upgrade Pathling Server to version 2.0.0, which resolves and canonicalizes the file path and rejects requests that escape the job directory
If upgrade is not immediately possible, disable async export operations by setting pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, and bulkSubmitEnabled to false
Enable authentication on the Pathling Server and restrict export capability to trusted callers only
Review warehouse access and web server logs for prior exploitation attempts referencing /$result

Patch Information

The fix is available in Pathling Server 2.0.0. In this release, the $result handler resolves and canonicalizes the requested file path, then rejects any request that escapes the job's jobs/<jobId> directory. Full details are provided in the GitHub Security Advisory GHSA-5h9r-m7r5-8jxq.

Workarounds

Disable all async export operations via the pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, and bulkSubmitEnabled configuration properties
Enable authentication and limit export permissions to a small set of trusted service accounts
Place a reverse proxy or WAF in front of Pathling to strip or reject file parameter values containing traversal sequences

bash

# Interim mitigation: disable async export operations in application.yml
pathling:
  operations:
    exportEnabled: false
    patientExportEnabled: false
    groupExportEnabled: false
    bulkSubmitEnabled: false