Path Traversal Vulnerability in Pathling Server Affecting Health Data Analytics

CVE-2026-47659

What is CVE-2026-47659?

Pathling Server has a vulnerability that allows attackers to exploit the /$result endpoint. By providing path traversal sequences in the file parameter, an unauthorized caller with access to a valid async export job ID can read files beyond their permitted scope. The issue arises because the server does not adequately normalize the requested file path to restrict access to the specific job's directory. This flaw could lead to unauthorized data exposure, particularly as async export scratch space shares the same database root with sensitive resource tables. The vulnerability has been addressed in version 2.0.0, which includes improvements to path resolution and access control.

References