CVE-2026-40506

Received Received - Intake

Path Traversal in OpenEMR Leading to Arbitrary Directory Deletion

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-40506

EUVD

EUVD-2026-60396

Affected Vendors & Products

Vendor	Product	Version / Range
openemr	openemr	to 8.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

OpenEMR before version 8.2.0 has a path traversal flaw in standard_tables_manage.php where the db parameter is passed to temp_dir_cleanup() without validation. This allows attackers to use traversal sequences to escape the intended temporary directory and trigger recursive directory deletion. An unauthenticated attacker can exploit this by chaining it with an open redirect in dicom_frame.php to craft a malicious URL that deletes arbitrary directories during an authenticated Superuser session.

Detection Guidance

To detect this vulnerability, check if your OpenEMR version is before 8.2.0. Inspect network traffic for requests to standard_tables_manage.php with a db parameter containing path traversal sequences like ../. Monitor for unusual directory deletions in PHP temporary directories.

Impact Analysis

This vulnerability allows unauthenticated attackers to delete arbitrary directories on the server where OpenEMR is running. If exploited, it could lead to loss of critical data, system instability, or denial of service. Attackers with Superuser privileges could cause significant damage by removing essential files or directories.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or corruption, violating GDPR's integrity principle and HIPAA's integrity and availability requirements. It may result in non-compliance, potential fines, or legal consequences due to compromised data security and availability.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.2.0 or later. If upgrading is not possible, restrict access to standard_tables_manage.php and dicom_frame.php via web server rules. Review and audit PHP temporary directory permissions to prevent unauthorized deletions.

Hi! I’m here to help you understand CVE-2026-40506. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70