CVE-2026-47661

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47661
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47661.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47661
Aliases
  • GHSA-8w85-f63v-3wh6
Published
2026-08-07T19:58:38.021Z
Modified
2026-08-11T11:36:33.605390137Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read
Details

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path traversal sequences. The handler verifies only the supplied job and never normalises or confines the requested file path to that job's jobs/<jobId> directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. As an interim mitigation, disable the async export operations (pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, bulkSubmitEnabled) or enable authentication and restrict export capability to trusted callers.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47661.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/aehrc/pathling

Affected ranges

Type
GIT
Repo
https://github.com/aehrc/pathling
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d31e6cab6c8fde1c9812ec6ec67d8d8def8414f3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47661.json"