What’s Vulnerable › Products

aehrc pathling vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your aehrc pathling version is affected

Latest aehrc pathling vulnerabilities

• CVE-2026-47664 — Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning (CVSS 8.6)
• CVE-2026-47663 — Pathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutation (CVSS 8.7)
• CVE-2026-47662 — Pathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLs (CVSS 8.7)
• CVE-2026-47661 — Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read (CVSS 8.7)
• CVE-2026-47660 — Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration (CVSS 8.7)
• CVE-2026-47659 — Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename} (CVSS 8.7)