CVE-2026-40506: Openemr

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.

Affected products

• Openemr Openemr: before 8.2.0 (fixed in 8.2.0)

Published 2026-08-17. Last modified 2026-09-09.