What is the CVSS score of CVE-2026-29187?

CVE-2026-29187 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-29187?

OpenEMR instances are vulnerable to SQL injection attacks that could expose protected health information (PHI) and patient records through the Patient Search feature.

How to fix or mitigate CVE-2026-29187?

Within 24 hours: Inventory all OpenEMR deployments and identify versions prior to 8.0.0.3; restrict Patient Search functionality to essential personnel only and audit recent search logs for suspicious activity. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in HTTP parameter keys; conduct PHI access audit to identify any unauthorized data exposure. Within 30 days: Plan and execute upgrade to OpenEMR 8.0.0.3 or later; consider network segmentation to isolate OpenEMR from other systems; conduct security assessment and employee training on secure coding practices.

PHP CVE-2026-29187

HIGH

SQL Injection (CWE-89)

2026-03-25 GitHub_M

PHP SQLi

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 22:47 vuln.today

CVE Published

Mar 25, 2026 - 22:24 nvd

HIGH 8.1

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.

AnalysisAI

A Blind SQL Injection vulnerability exists in OpenEMR's Patient Search functionality that allows authenticated attackers to execute arbitrary SQL commands by manipulating HTTP parameter keys instead of values. OpenEMR versions prior to 8.0.0.3 are affected. With a CVSS score of 8.1 (High), this vulnerability enables high confidentiality and integrity impact, allowing attackers to extract sensitive patient health records and potentially modify database contents, though exploitation requires low-privileged authentication.

Technical ContextAI

This vulnerability affects OpenEMR, an open-source electronic health records (EHR) and medical practice management application written in PHP. The affected component is the Patient Search functionality located in /interface/new/new_search_popup.php. The vulnerability is classified as CWE-89 (SQL Injection) and represents a blind SQL injection attack where the attacker manipulates HTTP parameter keys rather than parameter values—an unusual attack vector that bypasses typical input validation focused on parameter values. The CPE identifier cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* confirms this affects the OpenEMR application across multiple versions. Blind SQL injection allows attackers to infer database content through boolean-based or time-based queries even when error messages are not displayed.

RemediationAI

Upgrade OpenEMR to version 8.0.0.3 or later, which contains a patch for this vulnerability as documented in commit c61887aa7c83e83b3282db05246f1c00de3aa21d available at https://github.com/openemr/openemr/commit/c61887aa7c83e83b3282db05246f1c00de3aa21d. Review the complete security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-2r7h-xm8v-m872 for additional context. Until patching is completed, organizations should implement defense-in-depth measures including restricting access to the Patient Search functionality to only essential users, monitoring database query logs for anomalous SQL patterns, implementing web application firewall (WAF) rules to detect SQL injection attempts in parameter keys, and conducting audit reviews of user accounts with access to the affected functionality. Given the sensitive nature of healthcare data, prioritize this upgrade and ensure comprehensive logging is enabled to detect any potential exploitation attempts.