Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck
CVE-2026-40506OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
Medium 6.5
In plain English
A medium-severity path traversal in openemr from openemr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
References
- GitHub Security Advisory (GHSA-hj9x-33vw-5g3x) vendor-advisory
- OpenEMR v8_2_0 Release Notes release-notes
- Pull Request issue-tracking
- Patch Commit patch
- https://www.vulncheck.com/advisories/openemr-path-traversal-arbitrary-directory-deletion-via-standard-tables-manage-php third-party-advisory