CVE-2026-102843 Overview
CVE-2026-102843 is a path traversal vulnerability [CWE-22] in the open-source gedelumbung/HospitalManagement project on GitHub. The flaw resides in the hapus function of application/modules/admin/controllers/data_galeri.php. An authenticated remote attacker can manipulate the gbr argument to traverse outside the intended gallery directory and delete arbitrary files on the host.
Critical Impact
A remote attacker with valid administrator credentials can abuse the gallery deletion handler to remove arbitrary files, degrading application integrity and availability. Public exploit details have been released.
Affected Products
- gedelumbung HospitalManagement (all revisions up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8)
- Component: application/modules/admin/controllers/data_galeri.php (hapus function)
- Rolling-release repository with no versioned tags
Discovery Timeline
- 2026-09-30 - CVE-2026-102843 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-102843
Vulnerability Analysis
The hapus (Indonesian for "delete") controller action in data_galeri.php accepts a user-controlled gbr (gambar / image) parameter that identifies the gallery image to remove. The application concatenates this value directly into a filesystem path used by the deletion routine. Because the input is not normalized or restricted to the gallery directory, sequences such as ../ allow the request to escape the intended folder.
Exploitation requires an authenticated session with administrative privileges, which limits the scope but does not eliminate the risk. The maintainer was notified through a public issue report but has not responded, and the project uses continuous rolling releases without version tagging. See the GitHub Repository for Hospital Management and GitHub Issue #9 Discussion for the underlying report.
Root Cause
The root cause is missing input validation and path canonicalization on the gbr parameter before it is passed to the file deletion call. The controller trusts client-supplied filename data and does not enforce that the resolved path stays within the gallery upload directory.
Attack Vector
The attack is network-based and delivered through a standard HTTP request to the admin controller endpoint. An authenticated administrator submits a crafted gbr value containing directory traversal sequences, and the server processes the deletion against an attacker-chosen path. No user interaction beyond the attacker's own session is required.
A sanitized example of the exploitation pattern would be an HTTP request to the admin/data_galeri/hapus endpoint where the gbr parameter contains ../../ sequences to reference files outside the gallery folder. Refer to the VulDB CVE-2026-102843 Entry for the disclosed technical write-up.
Detection Methods for CVE-2026-102843
Indicators of Compromise
- HTTP requests to admin/data_galeri/hapus containing ../, ..\, URL-encoded (%2e%2e%2f), or double-encoded traversal sequences in the gbr parameter.
- Unexpected deletion of files outside the gallery upload directory used by HospitalManagement.
- Web server access logs showing authenticated admin sessions issuing deletion requests with abnormal gbr values.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule to flag traversal patterns in requests targeting data_galeri.php handlers.
- Enable file integrity monitoring on the application directory to alert on deletions originating from the web server process.
- Correlate admin authentication events with subsequent file-deletion actions to spot abuse of legitimate credentials.
Monitoring Recommendations
- Ship web server and PHP application logs to a centralized analytics platform and search for gbr= values containing path separators.
- Alert on any deletion targeting sensitive paths such as config/, .env, or system binaries adjacent to the web root.
- Track failed and successful admin logins to detect credential compromise that could precede exploitation.
How to Mitigate CVE-2026-102843
Immediate Actions Required
- Restrict access to the /admin/ interface using network ACLs or VPN gating until a patch is available.
- Rotate administrator credentials and enforce strong, unique passwords with multi-factor authentication where possible.
- Audit the gallery upload directory and adjacent paths for evidence of unauthorized deletions.
Patch Information
No vendor patch is available. The project uses continuous rolling releases without versioned tags, and the maintainer has not responded to the public GitHub Issue #9 Discussion. Organizations running this application should apply a local code fix that validates the gbr parameter against a whitelist of files in the gallery directory and rejects any input containing path separators or traversal sequences.
Workarounds
- Modify the hapus function in application/modules/admin/controllers/data_galeri.php to call basename() on the gbr input before constructing the deletion path.
- Enforce that the resolved path via realpath() resides within the intended gallery upload directory before invoking unlink().
- Set filesystem permissions so the web server user cannot delete files outside the gallery folder.
- Deploy WAF rules that block ../, ..\, and URL-encoded traversal variants in requests to admin controllers.
# Example WAF rule (ModSecurity) to block traversal in the gbr parameter
SecRule ARGS:gbr "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
"id:1026102843,phase:2,deny,status:403,\
msg:'CVE-2026-102843 path traversal attempt in HospitalManagement data_galeri hapus'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
