CVE-2019-14530

CVE-2019-14530 is a critical path traversal vulnerability in OpenEMR versions prior to 5.0.2, specifically within the custom/ajax_download.php script. An authenticated attacker can exploit this flaw to download arbitrary files from the server, potentially leading to full data compromise. The vulnerability also allows for the deletion of specific files if they are writable by the www-data user and reside in a particular directory. With a CVSS score of 8.8 (High) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk due to its low attack complexity and severe impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, public exploit code is available on ExploitDB and Nuclei templates exist, suggesting potential for active exploitation despite limited community discussion or media coverage.