A path traversal flaw in OpenEMR before 8.2.0 allows an attacker to provide a specially crafted value for the GET parameter used by standard_tables_manage.php. The value is passed directly to a cleanup routine that interprets it as a directory name and recursively deletes that directory. This causes loss of data and can lead to denial of service by removing critical system folders. The weakness underlying the issue is a classic path traversal flaw (CWE‑22).

All installations of OpenEMR running a version earlier than 8.2.0 are impacted. The vulnerability resides in the standard_tables_manage.php component used by the web interface and can be leveraged by an attacker who is able to influence the db parameter in an HTTP request. Version information indicates the fix is available in release v8.2.0, so any version prior to that should be considered vulnerable.

The CVSS score of 7.0 classifies the flaw as high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that known exploitation activity may be limited. Nevertheless, the flaw can be abused via an open redirect in dicom_frame.php, enabling an unauthenticated attacker to trigger recursive directory deletion within the context of an authenticated superuser session. This requires the attacker to first obtain or construct a URL that redirects through the vulnerable interface, but once achieved the impact is total loss of arbitrary directories. The risk is therefore significant for systems that expose the affected interface or allow open redirects.