OpenEMR <= 8.2.0: Remote Code Execution Vulnerability Reported
OpenEMR versions up to and including 8.2.0 reportedly contain a remote code execution vulnerability that allows authenticated administrators to execute arbitrary operating system commands.
What happened
OpenEMR through version 8.2.0 is under investigation for a critical vulnerability in the document category tree component. This vulnerability, tracked as CVE-2026-39932, allows authenticated administrators to execute arbitrary operating system commands. The issue arises from the ability to chain SQL execution to alter the id column type and insert a malicious PHP payload, which is subsequently executed via an unsanitized eval() call. This could potentially allow attackers to execute commands as the web server user.
To assess your exposure, check if you are running OpenEMR version 8.2.0 or earlier. It is recommended to upgrade to a version beyond 8.2.0 as soon as it becomes available. Additionally, review the integrity of your database to ensure no unauthorized changes have been made. For the most accurate and up-to-date information, consult the primary sources listed.
How 0Day mitigates this
openemr is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.