CVE-2026-47659 aehrc CVE debrief

Who should care

Defenders responsible for health data analytics systems using Pathling Server should assess exposure and prioritize patching to version 2.0.0 or later. Additionally, they should consider disabling async export operations or enabling authentication to restrict export capabilities to trusted callers.

Why it matters

CVE-2026-47659 is a high-severity vulnerability in Pathling Server that allows attackers to read files outside intended directories. Defenders should prioritize patching to version 2.0.0 or later and consider interim mitigations.

• Potential unauthorized file reads outside intended directories
• Possible data exposure through manipulated file parameters
• Need for verification of affected versions and remediation status
• Priority on patching or applying interim mitigations

Technical summary

The `/$result` endpoint in Pathling Server allows an attacker to read files outside the intended directory by manipulating the `file` parameter. This is due to the handler not normalizing or confining the requested file path. The issue is fixed in Pathling Server version 2.0.0, which resolves and canonicalizes the requested file path and rejects requests that escape the job's directory. The vulnerability has a CVSS score of 8.7 and is considered high-severity. Defenders should prioritize patching to version 2.0.0 or later.

Defensive priority

Defenders should prioritize patching Pathling Server to version 2.0.0 or later. As an interim mitigation, disable async export operations or enable authentication to restrict export capabilities to trusted callers.

Recommended defensive actions

• Patch Pathling Server to version 2.0.0 or later
• Disable async export operations as an interim mitigation
• Enable authentication to restrict export capabilities to trusted callers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, additional information on affected versions, exploitation, and victim impact is limited. The vulnerability has a high CVSS score of 8.7 and is considered a high-severity issue. There is no information on known exploits or attacks. Defenders should verify the affected versions and remediation status.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.