Pathling Server’s /$result endpoint validates the job ID but does not normalize the supplied file path. An attacker who can obtain any valid async export job ID can use a crafted file parameter with path‑traversal sequences to read any file under the warehouse database root. The vulnerability is a classic path traversal flaw (CWE‑22) that permits read of potentially sensitive warehouse data and other system files, compromising confidentiality.

The flaw exists in Pathling Server versions prior to 2.0.0. It affects any deployment of the Pathling Server component from the AEHRC Pathling product that has enabled async export operations. No specific patch version numbers are listed; the issue is fixed by upgrading to version 2.0.0 or later.

The CVSS score of 8.7 rates this issue as high severity. EPSS data is unavailable, and it is not listed in the CISA KEV catalog. Exploitation requires the ability to create or obtain a valid async export job ID; the attacker can create their own job if export creation is not restricted. Once a job ID is in hand, the attacker can supply a path‑traversal string to read arbitrary files. The combination of high severity and the ability for attackers to trigger the feature without additional privileges makes this a significant risk to affected systems.