This vulnerability arises from the hapus function in the data_galeri.php controller of the gedelumbung HospitalManagement application. A crafted value for the gbr parameter can cause a path traversal so that an attacker can read or delete arbitrary files on the server filesystem. The weakness is identified as CWE‑22, leading to unauthorized file access. The CVSS score of 5.1 indicates a moderate severity, with the exploit available publicly and an attack that can be launched remotely via the web application.

The affected vendor and product are gedelumbung:HospitalManagement. No specific version numbers are listed; the flaw exists in all releases up to the commit c2d45543789a3887067d3915f69d44cfc2cf76a8. Because the project uses continuous delivery, fixed releases may not be clearly identified until the change is merged.

The path traversal is remote in nature and can be exploited by an outsider through the admin endpoint. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the fact that the exploit has been released publicly indicates a non‑trivial risk. The vulnerability is not listed in the CISA KEV catalog, but the availability of public proof‑of‑concept code warrants caution. The impact is limited to unauthorized file access rather than full code execution or denial of service.