{"id":"CVE-2026-47664","title":"Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics","summary":"Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `export…","severity":"none","cwe":["CWE-20","CWE-345","CWE-918"],"published":"2026-08-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:02:22.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47664","references":[{"url":"https://github.com/aehrc/pathling/security/advisories/GHSA-69wc-hrxh-5528","label":"security-advisories@github.com"},{"url":"https://github.com/aehrc/pathling/security/advisories/GHSA-69wc-hrxh-5528","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00173,"epssPercentile":0.07039,"ingestedAt":"2026-09-09T21:22:45.524Z","slug":"CVE-2026-47664","body":"## Overview\n\nPathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}