A path traversal vulnerability in Pathling’s /$result endpoint allows an attacker who can obtain a valid asynchronous export job ID to craft a file parameter containing traversal sequences. The handler fails to normalize or confine the requested path to the specific job’s directory, enabling the attacker to read any file located under the warehouse database root. This effectively turns the endpoint into a read‑capable Server‑Side Request Forgery that can expose sensitive internal files and potentially expose persisted FHIR resources. The CVSS score of 8.7 indicates a high severity impact with significant confidentiality risk.

Pathling Server versions prior to 2.0.0 are affected. The vulnerability exists in the server component of the Pathling tool suite, which facilitates FHIR and clinical terminology analytics. No specific minor version details beyond 2.0.0 are provided, so any deployment using an earlier release should be considered vulnerable until patched.

The vulnerability’s high CVSS score combined with the lack of an EPSS rating and absence from the CISA KEV catalog suggest that while exploitation is plausible, it may not yet be widely automated. Attackers can exploit the flaw by sending an HTTP request to the /$result endpoint with syntactically crafted path traversal payloads, provided they possess at least one valid export job identifier. An authenticated or privileged attacker inside the network where Pathling is deployed can therefore read arbitrary files, potentially gaining access to sensitive medical data or configuration files. Mitigating through an upgrade or disabling export operations is therefore strongly recommended to reduce risk.