CVE-2026-47661 Overview
CVE-2026-47661 is a path traversal vulnerability [CWE-22] in Pathling Server, a toolset used for FHIR and clinical terminology analytics on health data. The flaw resides in the /$result endpoint, which fails to normalize or confine user-supplied file parameter values to the associated job's jobs/<jobId> directory. An unauthenticated attacker who obtains any valid async export job ID can traverse the warehouse database root and read arbitrary files, including persisted resource tables. The issue affects all versions prior to Pathling Server 2.0.0.
Critical Impact
Unauthenticated attackers can read arbitrary files from the Pathling warehouse, exposing patient FHIR resources and other stored clinical data.
Affected Products
- Pathling Server versions prior to 2.0.0
- Deployments with async export operations enabled (exportEnabled, patientExportEnabled, groupExportEnabled, bulkSubmitEnabled)
- Pathling instances without authentication restricting export capability
Discovery Timeline
- 2026-08-07 - CVE-2026-47661 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-47661
Vulnerability Analysis
Pathling's /$result endpoint serves the output of asynchronous FHIR export jobs. The handler validates the job parameter to confirm the referenced job exists but does not apply the same rigor to the file parameter. Attackers can supply file values containing ../ sequences to escape the intended jobs/<jobId> directory. Because async export scratch space and persisted resource tables share the same warehouse database root, traversal from one job directory can reach sibling tables.
The vulnerability enables confidentiality impact only; there is no write or execution primitive. However, in a FHIR context, the readable data typically includes protected health information (PHI) and other sensitive clinical records.
Root Cause
The root cause is missing path canonicalization and containment enforcement in the /$result handler. The code opens the file parameter as a filesystem resource without first resolving the path against the job's expected base directory and rejecting values that escape it. Standard defenses such as Path.normalize() followed by a startsWith() check against the allowed base are absent.
Attack Vector
An attacker first initiates their own async export job through endpoints such as $export, Patient/$export, Group/$export, or bulk submission. This yields a valid jobId that the /$result endpoint accepts. The attacker then requests /$result with the valid job value and a file parameter containing traversal sequences pointing to persisted Parquet tables or other files under the warehouse root. The server returns file contents directly to the caller over the network without authentication when default deployment settings apply.
Refer to the GitHub Security Advisory GHSA-8w85-f63v-3wh6 for the vendor's technical description.
Detection Methods for CVE-2026-47661
Indicators of Compromise
- HTTP requests to the /$result endpoint containing file parameter values with ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f.
- Access log entries showing /$result responses returning content sizes inconsistent with legitimate export outputs.
- Unexpected reads against Parquet files or warehouse table directories that sit outside jobs/<jobId> scratch paths.
Detection Strategies
- Deploy web application firewall or reverse proxy rules that inspect the file query parameter for path traversal patterns before the request reaches Pathling.
- Correlate async export job creation with subsequent /$result calls; flag when file values do not match the expected filenames produced by that job.
- Monitor filesystem audit logs on the warehouse volume for reads of resource table files initiated by the Pathling service account outside normal query workflows.
Monitoring Recommendations
- Enable verbose HTTP request logging on the Pathling Server and forward logs to a centralized analytics platform for retention and search.
- Alert on any successful /$result response whose byte size deviates significantly from historical baselines for legitimate export outputs.
- Track authentication state on requests to export and result endpoints; alert when unauthenticated callers reach these operations.
How to Mitigate CVE-2026-47661
Immediate Actions Required
- Upgrade Pathling Server to version 2.0.0 or later, which contains the fix for the traversal flaw.
- If upgrading is not immediately possible, disable async export operations by setting pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, and bulkSubmitEnabled to false.
- Enable authentication on the Pathling deployment and restrict export capability to trusted callers only.
- Review warehouse access logs for prior traversal activity and assess whether stored FHIR resources were exposed.
Patch Information
The vulnerability is fixed in Pathling Server 2.0.0. The patched release enforces path normalization and confines resolved file values to the corresponding jobs/<jobId> directory before serving content. Details are available in the GitHub Security Advisory GHSA-8w85-f63v-3wh6.
Workarounds
- Disable the four async export configuration flags to remove the vulnerable code paths from the request surface.
- Place Pathling behind an authenticating reverse proxy that enforces access control on /$export, Patient/$export, Group/$export, and /$result endpoints.
- Add reverse proxy rules that reject requests containing traversal sequences in query parameters.
- Isolate the warehouse database root so that persisted resource tables live on separate storage from async export scratch space where deployment topology permits.
# Interim mitigation: disable async export operations in Pathling configuration
pathling.operations.exportEnabled=false
pathling.operations.patientExportEnabled=false
pathling.operations.groupExportEnabled=false
pathling.operations.bulkSubmitEnabled=false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
