OpenEMR CVE-2026-39931

Exploitation requires an authenticated session with admin or super ACL privileges in OpenEMR - this is the critical high-privilege prerequisite that limits the attack surface to administrators, compromised admin accounts, or users who have been escalated to that role. The specific vulnerable code path is backup.php with the form_step=202 parameter, which must be reachable by the authenticated session; web server-level access controls blocking this path would prevent exploitation. The primary SQL injection and database manipulation capabilities (credential extraction, ACL modification, backdoor account creation) require only the admin session and are not gated on additional configuration. The most severe secondary capability - writing arbitrary files to the filesystem - requires two additional conditions that must both be true: the MySQL database user account must hold the FILE privilege, and the MySQL server's secure_file_priv variable must be set to an empty string or to a directory within the web root. These are non-default MySQL configurations that may not be present in hardened deployments, meaningfully reducing the file-write exposure in many environments. No victim interaction, timing windows, or race conditions are required once the attacker holds a qualifying admin session.

The CVSS 4.0 score of 8.6 with VC:H/VI:H/VA:H reflects confirmed high impact across all three security pillars once the admin threshold is cleared. The PR:H requirement is the primary risk limiter - this is not an unauthenticated external attack, but any compromised, malicious, or coerced administrator account enables full exploitation with low complexity (AC:L, AT:N). A publicly available exploit exists, substantially lowering the skill floor for post-authentication abuse. No CISA KEV listing is present, so active in-the-wild exploitation is not confirmed; however, the JivaSecurity writeup provides sufficient technical detail for replication. In healthcare environments where OpenEMR is deployed, the database contains PHI, credential hashes, and access control data, amplifying the downstream impact beyond a typical web application compromise. The conditional file write vector - requiring MySQL FILE privilege plus a permissive secure_file_priv setting - is not guaranteed in all deployments, but organizations that have not explicitly hardened MySQL configuration may be exposed to webshell persistence. No EPSS score was provided in the input data, so probability-based exploitation likelihood cannot be quantified. The realistic threat model centers on insider threat, account takeover, and privilege escalation from lower-privilege roles rather than direct external exploitation.

An attacker who has compromised or otherwise obtained OpenEMR administrator credentials authenticates to the application and navigates to the backup import interface, uploading a crafted SQL file through the backup.php form_step=202 endpoint; the server passes this file unfiltered to shell_exec invoking the mysql binary, executing arbitrary DDL and DML against the OpenEMR database. This enables extraction of PHI and bcrypt credential hashes, insertion of backdoor admin accounts into access control tables, and creation of persistent stored procedures or triggers for long-term persistence. Where the MySQL application user holds the FILE privilege and secure_file_priv is permissively configured, the attacker can additionally write a PHP webshell to the web root for persistent server-level code execution; a detailed public writeup is available at the JivaSecurity reference URL.