CVE-2026-40506: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-40506 is a path traversal vulnerability in OpenEMR's standard_tables_manage.php interface that allows arbitrary recursive directory deletion on the server. The db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and calls rmdir_recursive() on the result. All OpenEMR versions before 8.2.0 are affected. The vulnerability was published on August 17, 2026, with the fix merged on May 1, 2026 and released in OpenEMR 8.2.0 on July 8, 2026. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.0 (High) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the db GET parameter in interface/code_systems/standard_tables_manage.php flows unsanitized into filesystem operations. Specifically, $db = $_GET['db'] ?? '0' is passed directly to temp_dir_cleanup($db), which constructs the path $temporary_files_dir . '/' . $type and calls rmdir_recursive() on it without any normalization or containment check. A traversal sequence such as db=../../Example resolves outside the intended temporary directory, enabling deletion of arbitrary directories. The endpoint is gated by AclMain::aclCheckCore('admin', 'super'), so direct exploitation requires Superuser credentials; however, the advisory describes a chained attack using an open redirect in dicom_frame.php (Vulnerability 3) or a reflected XSS (Vulnerability 2) to trigger the deletion within an authenticated Superuser's browser session without requiring the attacker to hold Superuser credentials themselves (GitHub Advisory, Fix PR).

Successful exploitation results in arbitrary recursive directory deletion on the server, with high integrity and availability impact and no confidentiality impact. An attacker can destroy application data, configuration files, or critical system directories, leading to service disruption or complete application destruction. Via the chained attack (open redirect or XSS), an unauthenticated attacker can trigger this in a Superuser's session by enticing them to visit a crafted URL, significantly lowering the effective privilege bar (GitHub Advisory).

A proof-of-concept exploit script (PLT-2026-05-05.py) is publicly referenced in the GitHub Security Advisory, demonstrating both direct exploitation (requiring Superuser credentials) and a chained attack via open redirect. The NVD SSVC assessment classifies exploitation status as "poc" (proof-of-concept available). No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.0045 (0.45%), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify an internet-facing OpenEMR instance running a version prior to 8.2.0. Confirm the presence of the vulnerable endpoint at /interface/code_systems/standard_tables_manage.php.
2. Direct exploitation (Superuser required): Authenticate as a Superuser and send a crafted GET request with a path traversal payload in the db parameter, e.g., GET /interface/code_systems/standard_tables_manage.php?db=../../../../../../Example. The server joins this value to $temporary_files_dir and recursively deletes the resolved path.
3. Chained attack (no Superuser credentials needed): Craft a URL leveraging the open redirect in dicom_frame.php to redirect a Superuser's browser to the malicious endpoint: http://<host>/library/dicom_frame.php?web_path=/interface/code_systems/standard_tables_manage.php%3Fdb%3D..%2F..%2F..%2F..%2F..%2F..%2FExample.
4. Social engineering: Deliver the crafted URL to a Superuser via phishing, email, or another channel, causing their authenticated session to trigger the directory deletion.
5. Impact: The targeted directory (e.g., application data, configuration, or OS directories) is recursively deleted, resulting in data loss or service disruption (GitHub Advisory, Fix PR).

• Network: HTTP GET requests to /interface/code_systems/standard_tables_manage.php with a db parameter containing traversal sequences (e.g., ../, %2F..%2F, URL-encoded dot-dot-slash patterns); HTTP requests to /library/dicom_frame.php with a web_path parameter pointing to standard_tables_manage.php with an encoded db traversal payload.
• Logs: Web server access logs showing requests to standard_tables_manage.php?db= with values other than ICD9, ICD10, RXNORM, SNOMED, or CQM_VALUESET; PHP error logs indicating unexpected directory deletion or rmdir_recursive() calls on paths outside the temporary directory.
• File System: Unexpected disappearance of directories on the server, particularly application data, configuration, or system directories; missing files in directories that should be present after a recursive delete operation.
• Process: PHP process spawning unexpected filesystem operations (recursive directory removal) outside of the configured temporary_files_dir path.

Upgrade to OpenEMR 8.2.0 or later, which validates the db parameter against a strict whitelist (['ICD9', 'ICD10', 'RXNORM', 'SNOMED', 'CQM_VALUESET']) and throws a BadRequestHttpException (HTTP 400) for any other value. The fix also hardens temp_dir_cleanup() with realpath() and directory containment checks, and makes rmdir_recursive() symlink-safe. No configuration-based workaround is available for unpatched versions; restricting network access to the /interface/code_systems/standard_tables_manage.php endpoint and limiting Superuser account exposure can reduce risk until patching is possible (GitHub Advisory, OpenEMR 8.2.0 Release, Fix Commit).

The vulnerability was discovered by awoffsec (finder), coordinated by wsparks-vc, and remediated by kojiromike (OpenEMR contributor), as credited in the GitHub Security Advisory. The fix PR (#11951) underwent multiple rounds of AI-assisted security review (GitHub Copilot and Aisle Security bot), which identified additional TOCTOU and symlink traversal risks in the initial patch that were subsequently addressed before merge. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and pull request (GitHub Advisory, Fix PR).