CVE-2026-47659

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-47659

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47659.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-47659

Aliases

GHSA-5h9r-m7r5-8jxq

Published

2026-08-07T19:44:00Z

Modified

2026-09-11T03:30:20Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}

Details

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path traversal sequences. The handler verifies only the supplied job and never normalises or confines the requested file path to that job's jobs/<jobId> directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. The $result handler now resolves and canonicalizes the requested file path and rejects any request that escapes the job's jobs/<jobId> directory. As an interim mitigation, disable the async export operations (pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, bulkSubmitEnabled) or enable authentication and restrict export capability to trusted callers.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47659.json"
}

References

Affected packages

Git / github.com/aehrc/pathling

Affected ranges

Type

GIT

Repo

https://github.com/aehrc/pathling

Events

Introduced

Fixed

d31e6cab6c8fde1c9812ec6ec67d8d8def8414f3

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47659.json"