gedelumbung HospitalManagement EUVD-2026-89556

Requires an authenticated admin-level session (PR:H) to reach the 'hapus' action of application/modules/admin/controllers/data_galeri.php, which lives in the admin module. The attacker then supplies directory-traversal input in the 'gbr' argument. Exploitation is remote over the network with low complexity and no user interaction, but is fundamentally limited by the need for high-privilege access - this is not exploitable against a default unauthenticated attacker. No non-default configuration is required beyond having the gallery/admin functionality deployed.

This is a genuinely low-to-moderate priority issue despite a mid-range CVSS 4.0 score of 5.1. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L) is internally consistent with a path-traversal flaw in the 'hapus' (Indonesian for 'delete') function of an admin-module controller: high privileges are required (PR:H), and all three impacts are only Low. The function name and the manipulated 'gbr' (gambar/image) argument strongly imply arbitrary file deletion via traversal rather than arbitrary file read/RCE, which is why integrity/availability are rated Low rather than High. SSVC-style signals: exploitation is 'publicly available exploit code exists' (POC in GitHub issue #9), there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or automatable exploitation - the public exploit indicates opportunistic risk, not confirmed in-the-wild use. The dominant risk-limiting factor is PR:H: an attacker must already hold admin-level authenticated access to the application, which sharply narrows the realistic attacker population. Net: real but narrow - treat as a legitimate defect to patch, not an emergency.

An authenticated admin-level user of the HospitalManagement gallery module submits a crafted 'gbr' argument to the 'hapus' endpoint in data_galeri.php containing directory-traversal sequences (e.g. ../../) so the application resolves and deletes a file outside the intended gallery directory. Because a public exploit has been released (GitHub issue #9), a malicious insider or an attacker who has phished/compromised an admin session could delete arbitrary server-side files, degrading application integrity and availability. Attack is remote over the network but gated behind high-privilege authentication.