Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the "$import-pnp" operation in Pathling Server accepts a caller-supplied "exportUrl" and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local "file://" imports - bypassing the configured "allowableSources" allowlist that protects the ordinary "$import" operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the "$import-pnp" operation ("pathling.operations.importPnpEnabled=false") or do not configure PNP credentials.