CVE-2026-39931

OpenEMR through version 8.2.0 contains an authenticated SQL injection flaw in the backup configuration import feature of backup.php. An administrator holding admin or super ACL privileges can upload a crafted SQL file via the form_step=202 parameter, which the application passes to the MySQL command-line client through an unfiltered shell_exec call, allowing arbitrary DDL and DML statements to run against the application database. A successful attacker can extract password hashes, modify access-control tables, inject backdoor accounts, create persistent triggers or stored procedures, and where the MySQL user has FILE privileges and permissive secure_file_priv settings write arbitrary files to the server filesystem. All OpenEMR deployments running 8.2.0 or earlier are affected, though exploitation requires a compromised or malicious privileged account rather than anonymous access. No confirmed in-the-wild exploitation exists so far: the issue is not on the CISA KEV list, EPSS estimates a 0.4% probability of exploitation in the next 30 days, and public proof-of-concept writeups are available from Jiva Security and VulnCheck.

What to do: Upgrade to an OpenEMR release newer than 8.2.0 that includes the vendor fix, and limit admin/super ACL privileges to trusted users. Restrict the MySQL account used by the import feature so it lacks FILE privileges or enforce a restrictive secure_file_priv to prevent arbitrary file writes. Audit the database for unexpected triggers, stored procedures, new or backdoor accounts, and access-control changes on any instance where a privileged user may have imported a crafted backup file.