OpenEMR EUVD-2026-60396

Exploitation requires that (1) the target OpenEMR instance runs a version prior to 8.2.0 with the standard_tables_manage.php and dicom_frame.php endpoints accessible over the network; (2) an authenticated OpenEMR Superuser - the highest privilege role in the application - is actively logged in at the time of the attack; and (3) that Superuser can be induced to click or otherwise follow a crafted URL, typically via phishing, a compromised external page, or other social engineering. The attacker themselves requires no authentication or prior system access. Exploitation is constrained by: the mandatory social-engineering step targeting a Superuser specifically (not any authenticated user), the attacker's need to identify or guess a meaningful target directory path to delete, and the requirement that dicom_frame.php's open redirect is accessible and unfiltered. Non-default configurations that disable DICOM support or block external access to administrative PHP scripts would break the chain.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 7.0) contains an internal inconsistency that merits verification: PR:H reflects that Superuser-level session context is required for the deletion to execute, but UI:N contradicts the described attack mechanism, which explicitly requires a Superuser to follow a crafted link - this should map to UI:A (Active user interaction) in CVSS 4.0 terms. The vendor or NVD should be consulted for a corrected vector. Real-world exploitability is meaningfully gated by the social-engineering step: an attacker must successfully deliver a crafted URL to an actively authenticated Superuser, raising the practical bar compared to fully unauthenticated attacks. No EPSS score was provided and no CISA KEV listing exists, indicating neither statistically high exploitation probability nor confirmed in-the-wild abuse; however, the attack primitives (path traversal parameter injection and open redirect chaining) are well-understood, and the absence of a POC does not preclude private exploit development. The availability and integrity impact is severe and irreversible: recursive deletion of directories in a healthcare EHR can destroy patient records, application binaries, or database files, with downstream HIPAA and operational consequences. Despite the chained-exploit requirement, organizations running unpatched OpenEMR instances should treat this as urgent given the asymmetric damage potential.

An attacker identifies an internet-exposed OpenEMR deployment running a version prior to 8.2.0, then constructs a phishing email or malicious web page containing a URL that uses the open redirect in dicom_frame.php to chain to standard_tables_manage.php?db=../../var/www/openemr/sites/default. When a Superuser with an active session clicks the link, their browser follows the redirect and their authenticated session causes temp_dir_cleanup() to recursively delete the targeted directory - potentially destroying site configuration, uploaded patient documents, or application data. No public proof-of-concept has been identified, but both exploit primitives are individually trivial and well-documented in the security community.