CVE-2026-47661

{
  "id": "CVE-2026-47661",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T20:16:51.423",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers."
    },
    {
      "lang": "es",
      "value": "Pathling es un conjunto de herramientas que facilitan el uso de FHIR y la terminología clínica en el análisis de datos de salud. Antes de la versión 2.0.0 de Pathling Server, el endpoint “/$result” de Pathling permite a un llamador que puede obtener cualquier ID de trabajo de exportación asíncrono válido suministrar valores para el parámetro “file” que contienen secuencias de salto de ruta. El gestor verifica solo el “job” suministrado y nunca normaliza ni confina la ruta del “file” solicitado al directorio “jobs/[jobId]” de ese trabajo antes de abrirlo como un recurso del sistema de archivos. Debido a que el espacio temporal de exportación asíncrona reside bajo la misma raíz de la base de datos del almacén que las tablas de recursos persistentes, un atacante puede usar su propio trabajo de exportación para leer otros archivos del almacén. Esto se ha corregido en Pathling Server 2.0.0. Como mitigación provisional, deshabilite las operaciones de exportación asíncrona (“pathling.operations.exportEnabled”, “patientExportEnabled”, “groupExportEnabled”, “bulkSubmitEnabled”) o habilite la autenticación y restrinja la capacidad de exportación a llamadores de confianza."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "aehrc",
          "product": "pathling",
          "versions": [
            {
              "version": "< 2.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T01:12:05.773776Z",
          "id": "CVE-2026-47661",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/aehrc/pathling/security/advisories/GHSA-8w85-f63v-3wh6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/aehrc/pathling/security/advisories/GHSA-8w85-f63v-3wh6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}