CVE-2026-47664

Received Received - Intake

Pathling Server Credentialed FHIR Import Bypass

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-47664

EUVD

EUVD-2026-54651

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

Pathling Server before version 2.0.0 has a vulnerability in the $import-pnp operation. It allows attackers to supply a remote FHIR Bulk Export endpoint URL, which Pathling uses to download files from an untrusted source. These files are then treated as trusted local imports, bypassing security restrictions that normally protect the import process.

Detection Guidance

To detect this vulnerability, check if Pathling Server is running a version prior to 2.0.0. Verify if the `$import-pnp` operation is enabled and if PNP credentials are configured. Inspect server logs for unusual bulk export requests to untrusted hosts.

Impact Analysis

An attacker could exploit this to import malicious or unauthorized data into your system. This could lead to data corruption, unauthorized access to sensitive information, or other security breaches. The impact depends on the data processed by Pathling Server.

Compliance Impact

This vulnerability could lead to unauthorized data access or processing, violating GDPR's data protection principles or HIPAA's security requirements. It may result in non-compliance due to potential data breaches or improper data handling.

Mitigation Strategies

Disable the $import-pnp operation by setting pathling.operations.importPnpEnabled=false.
Do not configure PNP credentials if they are not required.
Upgrade Pathling Server to version 2.0.0 or later to address the issue.

Hi! I’m here to help you understand CVE-2026-47664. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70