What is the CVSS score of CVE-2026-32238?

CVE-2026-32238 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Openemr are affected by CVE-2026-32238?

CVE-2026-32238 affects OpenEMR versions before 8.0.0.2 and allows authenticated administrators to execute arbitrary system commands through the backup functionality, potentially compromising the…. A patch is available.

How to fix or mitigate CVE-2026-32238?

Within 24 hours: Identify all OpenEMR installations and their versions (check /var/www/openemr or equivalent; query database for version info). Within 7 days: Upgrade all instances to OpenEMR 8.0.0.2 or later; if immediate upgrade is impossible, restrict backup functionality access to a minimal set of trusted administrators and implement command-line auditing on the server. Within 30 days: Audit administrative account activity logs for suspicious backup operations and review any backup jobs executed in the past 90 days.

Openemr CVE-2026-32238

EUVD-2026-13158 CRITICAL

OS Command Injection (CWE-78)

2026-03-19 GitHub_M

Command Injection Openemr

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.0.2

EUVD ID Assigned

Mar 19, 2026 - 20:00 euvd

EUVD-2026-13158

Analysis Generated

Mar 19, 2026 - 20:00 vuln.today

CVE Published

Mar 19, 2026 - 19:30 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.

AnalysisAI

Command injection in OpenEMR's backup functionality (versions prior to 8.0.0.2) allows authenticated high-privilege users to execute arbitrary commands on the underlying system due to insufficient input validation. The CVSS 9.1 critical rating reflects the potential for complete system compromise, though exploitation requires valid administrative credentials. No patch is currently available for affected versions.

Technical ContextAI

OpenEMR is an open-source electronic health records and medical practice management application, identified by CPE cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), which occurs when user-supplied input is passed directly to system commands without proper sanitization. In this case, the backup functionality fails to properly validate input parameters before incorporating them into system commands, allowing attackers to inject additional commands that will be executed with the application's privileges.

RemediationAI

Upgrade OpenEMR to version 8.0.0.2 or later, which contains the security fix documented in commit 7bc7bd077a624e205daed17658de41af6070ef73 (https://github.com/openemr/openemr/commit/7bc7bd077a624e205daed17658de41af6070ef73). Until patching is possible, restrict administrative access to trusted users only, implement network segmentation to limit access to the OpenEMR instance, and monitor system logs for suspicious command execution patterns. Review the full security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-6pmc-3xm7-pm86 for additional context.