Remote code execution via unsanitized eval() in OpenEMR document category tree (CVE-2026-39932)

OpenEMR's Tree class (`library/classes/Tree.class.php`) constructs PHP code strings from database rows and passes them to an unsanitized `eval()` call when loading the document category tree. An authenticated administrator can chain a SQL import primitive to alter the `categories.id` column type from `INT(11)` to `VARCHAR(255)` and insert a PHP payload into that column; `eval()` then executes the payload as the web server user whenever any page instantiates `CategoryTree`, including unauthenticated and low-privilege pages. This results in arbitrary operating system command execution on the host running OpenEMR. Public POC available. Affected versions: - OpenEMR ≤ 8.2.0 (validated on 8.0.0.3 and 8.2.0) We recommend updating to: 8.3.0-dev. CVSS 9.4 · our assessment: act_now Reference: https://jivasecurity.com/writeups/openemr-eval-rce-category-tree-cve-2026-39932 Details: https://vuln.today/cve/CVE-2026-39932