CVE-2026-40506: OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicomframe.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.2.0 - Configuration
Update standard_tables_manage.php so the db GET parameter is validated/sanitized (no traversal sequences) before it is used by temp_dir_cleanup() to build the directory path.
standard_tables_manage.php (OpenEMR) db GET parameter validation before temp_dir_cleanup() = Validate db parameter to reject traversal sequences and enforce it maps to an intended subdirectory within temp_dir_cleanup() target directory
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40506?
The severity of CVE-2026-40506 is rated as medium with a score of 6.5.
How do I fix CVE-2026-40506?
To fix CVE-2026-40506, upgrade OpenEMR to version 8.2.0 or later.
What does CVE-2026-40506 affect?
CVE-2026-40506 affects OpenEMR versions prior to 8.2.0.
What type of vulnerability is CVE-2026-40506?
CVE-2026-40506 is a path traversal vulnerability that can lead to arbitrary directory deletion.
Can CVE-2026-40506 allow attackers to delete files?
Yes, CVE-2026-40506 can allow attackers to recursively delete directories due to improper validation of parameters.