---
id: CVE-2026-47664
title: >-
  Pathling is a set of tools that make it easier to use FHIR and clinical
  terminology within health data analytics
summary: >-
  Pathling is a set of tools that make it easier to use FHIR and clinical
  terminology within health data analytics. Prior to version 2.0.0 of Pathling
  Server, the `$import-pnp` operation in Pathling Server accepts a
  caller-supplied `export…
severity: none
cwe:
  - CWE-20
  - CWE-345
  - CWE-918
published: '2026-08-07'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47664'
references:
  - url: 'https://github.com/aehrc/pathling/security/advisories/GHSA-69wc-hrxh-5528'
    label: security-advisories@github.com
  - url: 'https://github.com/aehrc/pathling/security/advisories/GHSA-69wc-hrxh-5528'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00173
epssPercentile: 0.07033
ingestedAt: '2026-09-09T21:22:45.524Z'
---

## Overview

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.