EUVD-2026-60396Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker is unauthenticated (PR:N) but must social-engineer a Superuser via open redirect (UI:R); chaining two vulnerabilities raises complexity (AC:H); impact is integrity and availability only - no data disclosure occurs.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.
AnalysisAI
Recursive arbitrary directory deletion in OpenEMR before 8.2.0 is achievable by an unauthenticated attacker through a two-vulnerability chain: a path traversal flaw in standard_tables_manage.php allows the db GET parameter - passed unsanitized to temp_dir_cleanup() - to resolve outside the intended PHP temporary directory, while an open redirect in dicom_frame.php enables delivery of a crafted URL that triggers this deletion inside an authenticated Superuser's active session. The patch is confirmed in OpenEMR 8.2.0 (released 2026-07-08); no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that (1) the target OpenEMR instance runs a version prior to 8.2.0 with the standard_tables_manage.php and dicom_frame.php endpoints accessible over the network; (2) an authenticated OpenEMR Superuser - the highest privilege role in the application - is actively logged in at the time of the attack; and (3) that Superuser can be induced to click or otherwise follow a crafted URL, typically via phishing, a compromised external page, or other social engineering. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 7.0) contains an internal inconsistency that merits verification: PR:H reflects that Superuser-level session context is required for the deletion to execute, but UI:N contradicts the described attack mechanism, which explicitly requires a Superuser to follow a crafted link - this should map to UI:A (Active user interaction) in CVSS 4.0 terms. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The definitive fix is upgrading to OpenEMR 8.2.0 or later, released 2026-07-08 and available at https://github.com/openemr/openemr/releases/tag/v8_2_0; the specific patch is implemented in commit 2d8a69f0f343c8e8c6ee1b42d224c24a7a4ba415 via PR #11951 (https://github.com/openemr/openemr/pull/11951). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all OpenEMR deployments and identify instances running versions prior to 8.2.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today