Pathling Server versions before 2.0.0 have an improper limitation of pathname to a restricted directory (CWE-22) in the /$result endpoint. The endpoint accepts a file parameter that is not normalized or confined to the job-specific directory, allowing path traversal attacks. Since the async export scratch space shares the warehouse database root with persisted resource tables, an attacker can leverage their export job ID to read arbitrary files from the warehouse. This vulnerability has a CVSS 4.0 score of 8.7 (high severity) and does not require privileges or user interaction to exploit. The vulnerability is resolved in version 2.0.0.

An unauthenticated attacker who can obtain any valid async export job ID can exploit this vulnerability to read arbitrary files from the warehouse database root. This could lead to unauthorized disclosure of sensitive health data or other critical information stored alongside the export scratch space. The vulnerability does not require privileges or user interaction, increasing its risk. No known exploits in the wild have been reported.

This vulnerability is fixed in Pathling Server 2.0.0. Users should upgrade to version 2.0.0 or later to fully remediate the issue. As an interim mitigation, disable async export operations by setting pathling.operations.exportEnabled, patientExportEnabled, groupExportEnabled, and bulkSubmitEnabled to false, or enable authentication and restrict export capabilities to trusted callers. Patch status is not explicitly confirmed beyond the fixed version 2.0.0; check vendor advisories for updates.