CVE-2026-39932

OpenEMR through 8.2.0 contains a command-execution flaw in its document category tree component (library/classes/Tree.class.php), where values from the categories database table are passed into an unsanitized eval() call (CWE-95). An attacker who has obtained administrator-level access and can execute arbitrary SQL alters the id column of the categories table to VARCHAR and inserts a PHP payload, which is then executed whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages. Successful exploitation yields arbitrary operating-system command execution as the web server user, providing a persistent foothold until the database tampering is cleaned up. Any OpenEMR deployment running version 8.2.0 or earlier is affected, including self-hosted clinic and health-center installations. Exploitation has not been confirmed in the wild, but two public proof-of-concept write-ups exist, the flaw is rated 9.4 (Critical), EPSS currently estimates a 3.7% probability of exploitation within 30 days (89th percentile), and the issue is not in CISA's KEV catalog.

What to do: Upgrade OpenEMR to a release newer than 8.2.0 as soon as the project publishes a patched version, prioritizing internet-exposed instances. Until patched, audit the categories table for tampering (an id column changed to VARCHAR or unexpected stored values), remove arbitrary-SQL capability from untrusted administrator accounts, and restrict the web server user's OS command permissions. Given the public PoCs and rising EPSS, monitor logs for anomalous requests to pages that instantiate CategoryTree and for suspicious commands run as the web server user.