CVE-2019-14530: OpenEMR ajax_download.php path traversal allows arbitrary file read and delete

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw allows authenticated arbitrary file read and deletion with public exploit code and very high EPSS, though it is not known to be exploited in ransomware campaigns or listed in KEV.

What it is

OpenEMR before 5.0.2 contains a path traversal flaw in custom/ajax_download.php reachable through the fileName parameter. An attacker can read any file readable by the www-data user and, if the file is writable by www-data and the cqm_qrda directory exists, cause that file to be deleted from the server.

Impact

An attacker gains unauthorized read access to server files accessible to the web server account, which can expose sensitive data such as patient records or configuration, and can delete writable files, causing data loss or service disruption.

Attack surface

The flaw is reached over the network via the fileName parameter in custom/ajax_download.php. The CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N), so an authenticated low-privileged user can trigger it.

Exploitation

Public exploit code is referenced in multiple Packet Storm and GitHub advisories, and EPSS is 0.65529 (99.2nd percentile), indicating a high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Upgrade OpenEMR to 5.0.2 or later, which contains the fix referenced in PR 2592.
• Restrict access to custom/ajax_download.php to trusted roles and remove or disable it if not needed.
• Run the web server with least privilege and ensure www-data cannot write to sensitive directories such as cqm_qrda.
• Validate and canonicalize the fileName parameter to prevent path traversal, rejecting sequences like ../.
• Monitor and back up files in writable web directories to detect or recover from deletion.

Detection

• Inspect web server and application logs for requests to custom/ajax_download.php with fileName values containing ../ or absolute paths.
• Alert on access to files outside expected document directories via the ajax_download endpoint.
• Monitor for unexpected deletion or modification of files under /var/www/openemr/sites/default/documents/cqm_qrda/.
• Use file integrity monitoring on OpenEMR web directories to detect unauthorized reads or deletions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.