CVE-2026-39932: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-39932 is a remote code execution (RCE) vulnerability in OpenEMR's document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary OS commands by injecting PHP payloads into the categories database table. It affects OpenEMR through version 8.2.0. The vulnerability was published on August 3, 2026, with a CVSS v3.1 base score of 9.1 (High) and a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory).

The root cause is an eval injection flaw (CWE-95) in library/classes/Tree.class.php, where the CategoryTree class passes unsanitized database content directly into a PHP eval() call. An attacker with administrator privileges can chain an arbitrary SQL injection (CWE-89) to alter the id column type in the categories table from its native integer type to VARCHAR, then insert a malicious PHP payload as a category ID. Once persisted in the database, the payload is executed automatically whenever any page instantiates CategoryTree — including unauthenticated and low-privilege pages — resulting in OS command execution as the web server user (GitHub Advisory, VulnCheck Advisory). A technical write-up is available at the Jiva Security blog (Jiva Security).

Successful exploitation grants the attacker arbitrary OS command execution as the web server user, resulting in full compromise of confidentiality, integrity, and availability of the affected OpenEMR instance. Because the injected payload executes on any page that instantiates CategoryTree — including unauthenticated pages — the blast radius extends beyond the initial administrator-level compromise, potentially exposing sensitive patient health records (PHI/PII) to unauthorized parties and enabling lateral movement within the hosting environment (GitHub Advisory, VulnCheck Advisory).

The NVD SSVC assessment classifies exploitation status as "poc" (proof-of-concept exists), though no confirmed in-the-wild exploitation has been reported at this time (GitHub Advisory). The EPSS score is approximately 0.77% (53rd percentile), indicating a moderate near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (administrator access), which limits the attack surface but does not eliminate risk in environments with weak access controls.

1. Reconnaissance: Identify internet-facing OpenEMR instances running version 8.2.0 or earlier using tools like Shodan or Censys, or by inspecting the OpenEMR version disclosure on the login page.
2. Obtain administrator credentials: Authenticate to the OpenEMR admin panel using valid administrator credentials (obtained via phishing, credential stuffing, or other means).
3. Exploit SQL injection to alter column type: Using an administrative feature that permits arbitrary SQL execution (e.g., the OpenEMR SQL patch interface or a similar privileged endpoint), issue a SQL statement to alter the id column of the categories table from its integer type to VARCHAR: ALTER TABLE categories MODIFY id VARCHAR(255);
4. Inject malicious PHP payload: Insert a crafted row into the categories table with a PHP payload as the id value, e.g.: INSERT INTO categories (id, name) VALUES ('<?php system($_GET["cmd"]); ?>', 'malicious');
5. Trigger execution: Navigate to any OpenEMR page that instantiates the CategoryTree class (including unauthenticated pages). The unsanitized eval() call in Tree.class.php will execute the injected PHP payload as the web server user.
6. Achieve command execution: Pass OS commands via the injected web shell parameter (e.g., ?cmd=id) to execute arbitrary commands, establish a reverse shell, or exfiltrate data (GitHub Advisory, Jiva Security).

• Database: Unexpected VARCHAR type on the id column of the categories table; rows in the categories table containing PHP code strings (e.g., <?php, system(, eval(, base64_decode().
• Logs: OpenEMR or web server access logs showing requests to pages that instantiate CategoryTree (e.g., document management pages) with unusual query parameters such as cmd=, exec=, or encoded payloads; SQL audit logs recording ALTER TABLE categories or suspicious INSERT INTO categories statements from the application user.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM spawning /bin/sh, bash, curl, wget, or python).
• Network: Unexpected outbound connections from the web server to external IPs, particularly on non-standard ports, which may indicate reverse shell activity or data exfiltration.
• File System: New or modified files in the OpenEMR web root or /tmp directory, particularly PHP files or scripts not part of the original installation.

Update OpenEMR to a version released after 8.2.0 as soon as a patched release becomes available (GitHub Advisory). As interim mitigations: restrict administrator access to trusted personnel only and enforce multi-factor authentication on admin accounts; monitor the categories database table for unauthorized schema changes (particularly column type alterations) or suspicious data insertions; implement a web application firewall (WAF) rule to detect and block PHP code patterns in database-sourced content; and audit all uses of eval() in the codebase for unsanitized input. Replacing the eval() call in Tree.class.php with a safe alternative that does not execute arbitrary code is the recommended long-term code-level fix.

The vulnerability was assigned by VulnCheck and published to the GitHub Advisory Database on August 3, 2026, with a Critical severity rating (GitHub Advisory). A technical write-up was published by Jiva Security detailing the exploitation chain (Jiva Security), and VulnCheck issued a dedicated advisory (VulnCheck Advisory). No significant broader media coverage or notable social media reactions have been identified at this time.