CVE-2026-47659

{
  "id": "CVE-2026-47659",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T20:16:51.130",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. The `$result` handler now resolves and canonicalizes the requested file path and rejects any request that escapes the job's `jobs/<jobId>` directory. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers."
    },
    {
      "lang": "es",
      "value": "Pathling es un conjunto de herramientas que facilitan el uso de FHIR y la terminología clínica en el análisis de datos de salud. Antes de la versión 2.0.0 de Pathling Server, el punto final ’/$result’ de Pathling permite a un llamador que puede obtener cualquier ID de trabajo de exportación asíncrona válido proporcionar valores de parámetro ’file’ que contengan secuencias de salto de ruta. El gestor verifica solo el ’job’ proporcionado y nunca normaliza ni confina la ruta del ’file’ solicitada al directorio ’jobs/[jobId]’ de ese trabajo antes de abrirlo como un recurso del sistema de archivos. Debido a que el espacio de trabajo temporal de exportación asíncrona reside bajo la misma raíz de la base de datos del almacén que las tablas de recursos persistentes, un atacante puede usar su propio trabajo de exportación para leer otros archivos del almacén. Esto se soluciona en Pathling Server 2.0.0. El gestor ’$result’ ahora resuelve y canoniza la ruta del archivo solicitada y rechaza cualquier solicitud que escape del directorio ’jobs/[jobId]’ del trabajo. Como mitigación provisional, deshabilite las operaciones de exportación asíncrona (’pathling.operations.exportEnabled’, ’patientExportEnabled’, ’groupExportEnabled’, ’bulkSubmitEnabled’) o habilite la autenticación y restrinja la capacidad de exportación a llamadores de confianza."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "aehrc",
          "product": "pathling",
          "versions": [
            {
              "version": "< 2.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-10T13:28:37.926684Z",
          "id": "CVE-2026-47659",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/aehrc/pathling/security/advisories/GHSA-5h9r-m7r5-8jxq",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}