OpenEMR CVE-2026-39932

Exploitation requires an authenticated OpenEMR administrator account (or equivalent ability to run arbitrary SQL), consistent with CVSS PR:H, plus the target running OpenEMR 8.2.0 or earlier with the standard Tree.class.php/CategoryTree component. The concrete steps are: use SQL execution to ALTER the categories table id column to VARCHAR, then INSERT a PHP payload row. The key limiting factor is the admin/SQL privilege prerequisite - this is not a default-configuration pre-auth RCE. The key amplifier is that once the payload is stored, the malicious eval() fires whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, so no special configuration flag needs to be enabled and no further authentication is needed to trigger execution.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, score 9.4) reflects network-reachable, low-complexity exploitation that nonetheless requires high privileges (PR:H) - an administrator account - while producing full confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. The PR:H is the single biggest limiter: an attacker must already hold admin (or the ability to run arbitrary SQL) before planting the payload, so this is a privilege-escalation-to-code-execution and persistence primitive rather than a pre-auth internet worm. Publicly available exploit code raises operational risk and lowers the skill barrier, but POC availability is distinct from active exploitation - this CVE is not in CISA KEV, and no EPSS score was provided, so widespread automated exploitation cannot be asserted. The notable amplifier is that the injected payload executes on unauthenticated pages, meaning post-implant triggering needs no privileges at all; treat this as a high priority for any internet-exposed OpenEMR handling PHI, but weight it behind unauthenticated-RCE issues given the admin prerequisite.

An attacker who has obtained OpenEMR administrator credentials (via phishing, credential reuse, or a chained lower-severity flaw) uses the admin-accessible SQL execution path to alter the categories table id column to VARCHAR and insert a PHP web-shell payload. On the next request to any page that instantiates CategoryTree - including pages reachable without authentication - the unsanitized eval() runs the payload, giving the attacker command execution as the web server user. A public POC exists, so this can be reproduced quickly against a matching version.