What is CVE-2026-40506?
OpenEMR versions before 8.2.0 contain a path traversal vulnerability in the standard_tables_manage.php interface. An unauthenticated attacker can exploit the 'db' GET parameter to manipulate the temporary directory path, potentially leading to unauthorized deletion of files on the server. It is recommended to upgrade to OpenEMR 8.2.0 or later immediately.
Azərbaycanca: OpenEMR-in 8.2.0 versiyasından əvvəlki versiyalarında standart_tables_manage.php interfeysində path traversal zəifliyi aşkar edilib. Təsdiqlənməmiş istifadəçi 'db' GET parametri vasitəsilə müvəqqəti qovluğu hədəf alaraq serverdə icazəsiz fayl silmə əməliyyatları apara bilər. Təhlükəsizlik üçün dərhal OpenEMR-i 8.2.0 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
What vulnerability was discovered in the standard_tables_manage.php interface of OpenEMR?
A path traversal vulnerability was discovered in the standard_tables_manage.php interface of OpenEMR versions before 8.2.0.
What can an attacker do by exploiting this vulnerability?
An unauthenticated attacker can exploit the 'db' GET parameter to manipulate the temporary directory path, potentially leading to unauthorized deletion of files on the server.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.