CVE-2019-14530

PoC ×4—

CVSS 3.1

8.8 high

EPSS

66%p99

Published

Aug 13, 2019 (Aug 13, 2019)

Modified

Jun 17, 2026

Description

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.

Vendors: open-emr
Products: openemr
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (65.5%)

In the news0 stories

No ingested article mentions this CVE yet.