This vulnerability exists in gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected component is the 'hapus' function in 'application/modules/admin/controllers/data_galeri.php'. By manipulating the 'gbr' parameter, an attacker can perform a path traversal attack remotely. The software uses continuous delivery with rolling releases, so no discrete version numbers are provided for affected or fixed releases. The project has been notified but has not yet provided a fix or response. Exploit code has been publicly released.

Successful exploitation allows remote attackers to perform path traversal, potentially accessing or modifying files outside the intended directory. This can lead to unauthorized data access or modification. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. The presence of public exploit code increases the likelihood of attacks.

No official fix or patch has been released yet. Since the project has not responded or provided remediation, users should monitor the vendor's channels for updates. Until a patch is available, consider restricting access to the affected endpoint or applying web application firewall rules to block malicious path traversal payloads targeting the 'gbr' parameter.