CVE-2026-102843: gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal
A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/datagaleri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges (PR:H). Exploitation can be initiated remotely and does not require user interaction.
What impact could successful exploitation have?
The available assessment indicates low impact to confidentiality, integrity, and availability. The path traversal occurs through the gbr argument handled by the hapus function in the gallery-data endpoint.
How can I determine whether my deployment is affected?
Deployments containing application/modules/admin/controllers/data_galeri.php with the vulnerable hapus function should be considered affected. The project uses rolling releases, so no reliable affected or fixed version range is available.
What should I do if an update is not available?
Restrict access to the affected administrative endpoint to authorized users, since exploitation requires high privileges. Review and constrain path values supplied through the gbr argument, and monitor administrative requests to this endpoint for traversal sequences.
Is public exploitation information available?
Yes. Public exploit information has been released, increasing the likelihood that the issue may be used in attacks.