CVE-2026-40506 in OpenEMR
Summary
by MITRE • 08/17/2026
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in OpenEMR versions prior to 8.2.0 represents a critical security flaw rooted in improper input validation and insecure direct object references. Specifically, the standard_tables_manage.php interface accepts a db parameter via HTTP GET requests without performing adequate sanitization or path normalization checks. This unchecked value is subsequently passed directly into the temp_dir_cleanup() function, which constructs a file system path by concatenating the user-supplied input with the PHP temporary directory base path. The core technical failure lies in the absence of boundary enforcement mechanisms that would prevent the traversal sequence from escaping the intended sandboxed environment. By injecting standard directory traversal characters such as dot-dot-slash sequences into this parameter, an attacker can manipulate the resulting file system path to resolve outside the designated temporary directory structure. This lack of validation allows for arbitrary recursive deletion operations targeting directories and files located anywhere on the server's file system where the web application process has write permissions.
The operational impact of this vulnerability is severe due to its potential for causing significant denial of service and data integrity loss. Because the affected function performs a recursive delete operation, successful exploitation can lead to the permanent removal of critical configuration files, database backups, or other essential components required for the healthcare information system's operation. The severity is further amplified by the fact that this flaw can be chained with an open redirect vulnerability present in dicom_frame.php. This chaining capability allows an unauthenticated attacker to craft a malicious URL that leverages the open redirect to bypass initial access controls and deliver the crafted traversal payload within the context of an authenticated Superuser session. Consequently, even users who have not yet logged in can trigger destructive actions if they trick an administrator into clicking a specially constructed link, effectively turning a low-privilege vector into a high-impact compromise event that undermines the confidentiality, integrity, and availability of the entire system.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths or path components so they do not affect the intended control flow. Additionally, the exploitation technique involving crafted URLs and session context manipulation corresponds to ATT&CK techniques such as T1059: Command and Scripting Interpreter for executing system commands via web application interfaces, and potentially T1486: Data Encrypted for Impact if the deletion leads to ransomware-like scenarios or data destruction. The open redirect component also relates to CWE-601: URL Redirection to Untrusted Site, which facilitates phishing attacks and can be used as a vector to bypass authentication checks by masking malicious payloads behind trusted domains.
To mitigate this vulnerability, immediate remediation requires updating OpenEMR to version 8.2.0 or later where these issues have been addressed through rigorous input validation and path canonicalization techniques. In the interim, administrators should implement strict allow-listing for any parameters that influence file system operations, ensuring that only expected alphanumeric values are accepted. It is also critical to enforce proper session management policies and disable unnecessary features such as DICOM frame handling if not actively used in production environments. Web Application Firewalls can be configured to detect and block common path traversal patterns like dot-dot-slash sequences within GET parameters. Furthermore, applying the principle of least privilege ensures that the web server process operates with minimal file system permissions, thereby limiting the blast radius should an exploitation attempt succeed. Regular security audits and code reviews focusing on dynamic file inclusion and deletion functions are essential to prevent similar vulnerabilities from being introduced in future updates or custom modules.