CVE-2026-40506: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-40506 is a path traversal vulnerability in OpenEMR's standard_tables_manage.php interface that enables arbitrary recursive directory deletion on the server. The db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and calls rmdir_recursive() on the result. All OpenEMR versions before 8.2.0 are affected. The vulnerability was published on August 17, 2026, with the fix merged on May 1, 2026, and included in the OpenEMR 8.2.0 release on July 8, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.0 (High) (Feedly, GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the db GET parameter in interface/code_systems/standard_tables_manage.php flows unsanitized into filesystem operations. Specifically, temp_dir_cleanup($db) concatenates the unvalidated $db value directly to $temporary_files_dir and passes the result to rmdir_recursive(), allowing traversal sequences such as db=../../something to resolve outside the intended temporary directory. The endpoint is gated by AclMain::aclCheckCore('admin', 'super'), so direct exploitation requires Superuser credentials; however, the advisory describes a chained attack path where an open redirect in dicom_frame.php (Vulnerability 3) or a reflected XSS (Vulnerability 2) can be used to deliver a crafted URL that triggers the deletion within an authenticated Superuser's browser session, bypassing the credential requirement. A PoC script (PLT-2026-05-05.py) is referenced in the advisory for direct exploitation (GitHub Advisory, GitHub PR).

Successful exploitation results in arbitrary recursive directory deletion on the server, with high integrity and availability impact and no confidentiality impact. An attacker can destroy application data, configuration files, or critical system directories, leading to service disruption or complete application unavailability. In a chained attack scenario, a non-privileged attacker can trigger this destructive action within a Superuser's session by enticing them to visit a crafted URL, effectively bypassing the Superuser privilege requirement (GitHub Advisory).

A PoC script (PLT-2026-05-05.py) is referenced in the official GitHub Security Advisory for direct exploitation requiring Superuser credentials. The chained attack vector — combining the open redirect in dicom_frame.php with a crafted URL — allows unauthenticated or low-privileged attackers to trigger the vulnerability in a Superuser's session without direct credentials. No evidence of in-the-wild exploitation, threat actor attribution, EPSS score, or CISA KEV catalog listing is currently available for this CVE (GitHub Advisory, Feedly).

1. Reconnaissance: Identify an internet-facing OpenEMR instance running a version prior to 8.2.0. Confirm the presence of the vulnerable endpoint at /interface/code_systems/standard_tables_manage.php.
2. Direct exploitation (requires Superuser): Authenticate as a Superuser and send a crafted GET request with a traversal payload in the db parameter, e.g., GET /interface/code_systems/standard_tables_manage.php?db=../../../../../../target_directory. The server will recursively delete the resolved directory.
3. Chained attack (no Superuser credentials required): Craft a URL leveraging the open redirect in dicom_frame.php to redirect a Superuser's browser to the malicious endpoint: http://<host>/library/dicom_frame.php?web_path=/interface/code_systems/standard_tables_manage.php%3Fdb%3D..%2F..%2F..%2F..%2F..%2F..%2FExample.
4. Social engineering: Deliver the crafted URL to a Superuser via phishing, email, or another social engineering vector, enticing them to click the link while authenticated.
5. Trigger deletion: When the Superuser visits the URL, their authenticated session causes temp_dir_cleanup() to execute rmdir_recursive() on the traversal-resolved path, deleting the targeted directory tree on the server (GitHub Advisory).

• Network: Unusual GET requests to /interface/code_systems/standard_tables_manage.php with URL-encoded traversal sequences (e.g., %2F..%2F, ../../) in the db parameter; GET requests to /library/dicom_frame.php with a web_path parameter pointing to standard_tables_manage.php with encoded traversal payloads.
• Logs: Web server access logs showing requests to standard_tables_manage.php?db= with values other than ICD9, ICD10, RXNORM, SNOMED, or CQM_VALUESET; PHP error logs indicating unexpected directory deletion or rmdir_recursive() calls on paths outside the configured temporary_files_dir.
• File System: Unexpected absence of directories that should exist on the server (application data, configuration directories, or web root subdirectories); missing OpenEMR application files or data directories following a Superuser session.
• Process: PHP process spawning unexpected filesystem operations (recursive directory removal) outside the designated temporary files directory (GitHub Advisory).

Upgrade to OpenEMR 8.2.0 or later, which was released on July 8, 2026, and includes the fix merged via PR #11951 (OpenEMR Release). The patch validates the db parameter against a strict whitelist (['ICD9', 'ICD10', 'RXNORM', 'SNOMED', 'CQM_VALUESET']) and hardens temp_dir_cleanup() with realpath-based containment checks and symlink-safe recursive deletion (GitHub Commit). As a temporary workaround prior to patching, restrict network access to the standard_tables_manage.php endpoint and dicom_frame.php to trusted administrative IP addresses only, and ensure Superuser accounts are used with caution when clicking external links.

The vulnerability was discovered by awoffsec and coordinated by wsparks-vc, with remediation developed by kojiromike, as credited in the official GitHub Security Advisory (GitHub Advisory). The PR discussion included automated security analysis from the Aisle security bot, which flagged additional TOCTOU and symlink traversal risks in the initial fix, prompting multiple rounds of hardening before the PR was merged (GitHub PR). No broader media coverage or notable social media reactions have been identified at this time.