Pathling Server before version 2.0.0 has a path traversal vulnerability (CWE-22, CWE-918) in its `/$result` endpoint. The endpoint accepts a `file` parameter that is not normalized or confined to the expected job directory, allowing an attacker with any valid async export job ID to read arbitrary files from the warehouse database root. This occurs because the handler verifies only the job ID but does not restrict the file path to the job's `jobs/<jobId>` directory. The vulnerability is resolved in version 2.0.0 by resolving and canonicalizing the requested file path and rejecting requests that escape the job directory. Interim mitigations include disabling async export features or enforcing authentication and access control on export operations.

An unauthenticated attacker who can obtain any valid async export job ID can exploit this vulnerability to read arbitrary files from the warehouse database root. This could lead to unauthorized disclosure of sensitive health data and other resources stored alongside the export scratch space. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating network exploitable with no privileges or user interaction required and high impact on confidentiality.

A fix is available in Pathling Server version 2.0.0, which properly canonicalizes and restricts file paths to the job directory. Until upgrading, it is recommended to disable async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capabilities to trusted callers to mitigate exploitation risk.