CVE-2026-40506: OpenEMR Path Traversal Vulnerability

CVE-2026-40506 Overview

CVE-2026-40506 is a path traversal vulnerability in OpenEMR versions prior to 8.2.0. The flaw resides in the standard_tables_manage.php interface, where the db GET parameter is passed unvalidated to the temp_dir_cleanup() function. That function joins the attacker-controlled value to the PHP temporary directory path and recursively deletes the resulting directory. When chained with an open redirect in dicom_frame.php, an unauthenticated attacker can craft a URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's browser session. The weakness is tracked under CWE-22.

Critical Impact
A crafted link clicked by an authenticated OpenEMR Superuser can recursively delete arbitrary directories on the server, resulting in data loss and service disruption.

Affected Products

OpenEMR versions prior to 8.2.0
OpenEMR standard_tables_manage.php interface (vulnerable component)
OpenEMR dicom_frame.php interface (open redirect used in chained exploitation)

Discovery Timeline

2026-08-17 - CVE-2026-40506 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-40506

Vulnerability Analysis

The vulnerability exists in OpenEMR's standard tables management workflow. The standard_tables_manage.php script accepts a db parameter from the query string and forwards it to the temp_dir_cleanup() helper without sanitization or allow-list validation. temp_dir_cleanup() concatenates the attacker-supplied value onto the PHP temporary directory path and then performs a recursive delete on the resulting filesystem location.

Because the input is neither canonicalized nor constrained to a known-good identifier, traversal sequences such as ../ resolve outside the intended temporary directory. Any path the PHP process user can reach becomes a candidate for deletion, including application files, uploaded medical records, and configuration data.

Root Cause

The root cause is missing input validation on a filesystem-influencing parameter, classified as improper limitation of a pathname to a restricted directory [CWE-22]. The db value should be constrained to a known set of database identifiers, but the pre-patch code path treats it as arbitrary string input suitable for path concatenation.

Attack Vector

Exploitation requires an authenticated Superuser session in the browser, but the attacker themselves does not need credentials. The attacker delivers a crafted URL, typically via phishing, that abuses the open redirect in dicom_frame.php to route the victim's browser through standard_tables_manage.php with a traversal payload in the db parameter. The victim's session performs the destructive recursive delete against the server filesystem.

php

// Patch reference: .phpstan/baseline/argument.type.php
// Source: https://github.com/openemr/openemr/commit/2d8a69f0f343c8e8c6ee1b42d224c24a7a4ba415
     'count' => 15,
     'path' => __DIR__ . '/../../interface/code_systems/list_staged.php',
 ];
-$ignoreErrors[] = [
-    'message' => '#^Parameter \\#1 \\$text of function text expects string, mixed given\\.$#',
-    'count' => 2,
-    'path' => __DIR__ . '/../../interface/code_systems/standard_tables_manage.php',
-];
 $ignoreErrors[] = [
     'message' => '#^Parameter \\#1 \\$value of method OpenEMR\\\\Common\\\\Crypto\\\\CryptoInterface\\:\\:cryptCheckStandard\\(\\) expects string\\|null, string\\|false given\\.$#',
     'count' => 1,

The removed PHPStan baseline entries indicate that standard_tables_manage.php previously passed mixed (untyped external input) into functions expecting string. The fix (#11951) enforces validation of the db parameter before it reaches temp_dir_cleanup(). See the GitHub Pull Request for the full change set.

Detection Methods for CVE-2026-40506

Indicators of Compromise

HTTP GET requests to standard_tables_manage.php containing traversal sequences such as ../ in the db parameter.
Requests to dicom_frame.php immediately followed by cross-site navigations to standard_tables_manage.php within the same Superuser session.
Unexpected deletion of directories under the OpenEMR install path, uploaded document stores, or the PHP sys_get_temp_dir() location.
Web server access logs showing referers from external domains preceding destructive filesystem activity by the PHP worker process.

Detection Strategies

Alert on any query string to standard_tables_manage.php whose db parameter fails to match an allow-list of known database identifiers.
Correlate web request telemetry with filesystem unlink and rmdir syscalls originating from the PHP-FPM or Apache worker process.
Hunt for open-redirect abuse of dicom_frame.php by inspecting outbound Location headers against a known-good allow-list of internal destinations.

Monitoring Recommendations

Enable web application firewall (WAF) rules that block %2e%2e%2f, ..%2f, and ../ sequences on OpenEMR endpoints.
Monitor OpenEMR installation directories with file integrity monitoring (FIM) tooling and alert on bulk deletions.
Forward web access logs and PHP error logs to a central data lake to enable retrospective hunting for the request pattern.

How to Mitigate CVE-2026-40506

Immediate Actions Required

Upgrade OpenEMR to version 8.2.0 or later, tracked in the GitHub Release Tag v8.2.0.
Restrict access to standard_tables_manage.php to trusted administrative networks using reverse proxy or web server ACLs.
Instruct Superusers to avoid clicking untrusted links while authenticated to OpenEMR and to log out when the application is not in use.
Back up the OpenEMR filesystem and database before applying the patch to enable recovery if deletion has already occurred.

Patch Information

The fix is delivered in OpenEMR 8.2.0 via commit 2d8a69f and merged through pull request #11951. Additional detail is available in the GitHub Security Advisory GHSA-hj9x-33vw-5g3x and the VulnCheck Path Traversal Advisory.

Workarounds

Deploy a WAF rule that rejects requests to standard_tables_manage.php when the db parameter contains path separators or dot sequences.
Configure the web server to block or rewrite requests to dicom_frame.php that include external redirect targets until the upgrade is applied.
Reduce the OpenEMR PHP process account's filesystem privileges so recursive deletion cannot reach application, backup, or archive directories.
Require re-authentication for administrative pages by shortening Superuser session lifetimes.

bash

# Example ModSecurity rule to block traversal on the vulnerable endpoint
SecRule REQUEST_URI "@contains /interface/code_systems/standard_tables_manage.php" \
    "chain,id:1040506,phase:2,deny,status:403,log,msg:'CVE-2026-40506 traversal attempt'"
  SecRule ARGS:db "@rx (\.\./|\.\.\\|%2e%2e)" "t:none,t:urlDecodeUni"