Path Traversal in Pathway Document Store

Executive Summary

CVE-2026-59094 is a high-severity vulnerability in Pathway versions 0.31.1 and earlier. It involves an unauthenticated Denial of Service (DoS) attack caused by exponential glob pattern matching in the document store. The document store uses a recursive matcher for glob patterns containing the ** token, which branches two ways without memoization, leading to exponential worst-case time complexity. An attacker can send a short HTTP request with many ** tokens to unauthenticated endpoints (/v1/retrieve, /v1/inputs, /v2/answer), causing the system to consume CPU resources for tens of seconds per request. A small number of such requests can deny service to the system.

The root cause is the recursive implementation of the glob pattern matcher that does not cache intermediate results, causing an exponential number of recursive calls when processing patterns with multiple ** tokens. This leads to excessive CPU consumption and a Denial of Service condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by a remote unauthenticated attacker to cause a Denial of Service (DoS) on the Pathway document store and related REST endpoints. By sending specially crafted requests with glob patterns containing many ** tokens, the attacker can cause the system to consume excessive CPU resources for tens of seconds per request.

The impact includes CPU exhaustion, which can degrade system performance or make the service unavailable to legitimate users. Even a small number of such malicious requests can effectively deny service, disrupting normal operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually high CPU usage on the system when handling requests to the unauthenticated REST endpoints /v1/retrieve, /v1/inputs, and /v2/answer. Specifically, look for requests containing the filepath_globpattern parameter with many '**' tokens, which cause exponential CPU consumption.

Testing can be performed by sending crafted HTTP requests with glob patterns containing multiple '**' tokens to these endpoints and observing CPU usage or response delays.

Example command using curl to test the vulnerability by sending a malicious pattern:

• curl -X POST http://<target-host>/v1/retrieve -d '{"filepath_globpattern": "**/a/**/a/**/a/**/a/**/b"}' -H 'Content-Type: application/json'

Monitoring tools or scripts can be used to detect high CPU usage spikes correlated with such requests.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or limiting the usage of the filepath_globpattern parameter in requests to the affected endpoints (/v1/retrieve, /v1/inputs, /v2/answer).

• Implement input validation to cap the number of '**' tokens and the total length of the filepath_globpattern parameter at the request boundary.
• Consider adding authentication to these REST endpoints to prevent unauthenticated access.
• Apply the official fix by updating Pathway to a version including the commit d09722e, which introduces memoization in the glob matching function to prevent exponential complexity.

Until the patch is applied, monitoring and rate limiting requests to these endpoints can help reduce the risk of denial of service.

Useful 0 Not Useful 0