Arbitrary directory deletion via db traversal

Path traversal in standard_tables_manage.php in OpenEMR before 8.2.0 allows attackers to delete server directories via the db parameter. The page passes db from the GET request to temp_dir_cleanup(), which appends it to temporary_files_dir and calls rmdir_recursive() on the resulting path without normalization; traversal sequences therefore escape the intended temporary directory. Direct reachability is limited to Administration - Superuser users, but the vendor advisory shows that an unauthenticated attacker can chain dicom_frame.php open redirect behavior to force a Superuser session to issue the deletion request, causing recursive data loss and service interruption.