Description

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T21:16:44.930Z",
  "pubdate": "2026-08-17T21:16:44.930Z",
  "executiveSummary": "OpenEMR before 8.2.0 suffers from a path traversal vulnerability residing within the standard_tables_manage.php interface. The flaw allows unauthenticated attackers to leverage an open redirect in dicom_frame.php to deliver a crafted URL that triggers arbitrary recursive directory deletion within the context of an authenticated Superuser's session. The root cause stems from the unsanitized db GET parameter being passed directly into the temp_dir_cleanup() function, which subsequently concatenates the input with the PHP temporary directory path and performs a recursive deletion operation. The impact of successful exploitation includes significant data loss and denial of service via the destruction of arbitrary directories accessible to the web server user. Exploitation requires chaining the path traversal vector with an open redirect to target an active session of a privileged user.",
  "technicalDetails": "The vulnerability exists in the OpenEMR application prior to version 8.2.0, specifically involving the standard_tables_manage.php interface and the temp_dir_cleanup() function. The root cause is improper input validation of the db GET parameter. When a request is processed, the db parameter is accepted without sufficient sanitization or validation checks and is directly supplied to the temp_dir_cleanup() function. This function appends the supplied value to the system PHP temporary directory path and executes a recursive directory deletion on the resulting target path.\nBecause path traversal sequences (such as dot-dot-slash patterns) are not filtered or blocked, an attacker can supply directory traversal payloads within the db parameter. This forces the path resolution mechanism to traverse outside the boundaries of the intended temporary directory, targeting arbitrary file system locations accessible to the underlying web server execution context.\nTo achieve exploitation without direct authentication, the attack flow chains this path traversal vulnerability with an open redirect vector located in dicom_frame.php. An unauthenticated attacker crafts a malicious URL combining the open redirect mechanism and the path traversal payload in standard_tables_manage.php. The attacker then delivers this crafted URL to an authenticated Superuser. When the Superuser interacts with the malicious link, the open redirect facilitates the execution flow, and the resulting request triggers standard_tables_manage.php with the malicious db parameter.\nThe payload behavior results in the execution of temp_dir_cleanup(), which resolves the traversed path and initiates a recursive deletion of the targeted directory structure. The post-exploitation impact includes severe integrity and availability degradation, characterized by the arbitrary removal of critical system files, application dependencies, or user data, depending on the privileges of the web application process and the paths reached during traversal."
}