CVE-2026-40506

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.2.0

Description A path traversal issue exists in the 'standard tables manage.php' interface. The db GET parameter is passed without validation to the temp dir cleanup() function, which appends the value to the PHP temporary directory path and recursively deletes the resulting directory. By using a traversal sequence in the db parameter and combining it with an open redirect in 'dicom frame.php', an unauthenticated attacker can send a crafted URL that causes arbitrary recursive directory deletion when accessed by an authenticated Superuser session.

Recommendations Update to version 8.2.0 or later. As a temporary mitigation, restrict access to the 'standard tables manage.php' interface or avoid using the db parameter until the update is applied.