Advisories · Technology
aehrc pathling.
Every CVE that names aehrc pathling among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning
- aehrc pathling
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 8.7 High
Pathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutation
- aehrc pathling
- Broken access control
- CVSS 8.7 High
Pathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLs
- aehrc pathling
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read
- aehrc pathling
- Path traversal
- CVSS 8.7 High
Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration
- aehrc pathling
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}
- aehrc pathling
- Path traversal
- Server-side request forgery (SSRF)