EUVD-2026-52345
GHSA-pj78-c8jq-8xhf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires admin/SQL privileges so PR:H; network-reachable and low-complexity; stored payload later executes via unauthenticated pages as the web-server user, justifying S:C with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user.
Articles & Coverage 1
AnalysisAI
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so that arbitrary PHP runs as the web server user. The flaw lives in library/classes/Tree.class.php, where an attacker chains SQL execution to change the categories table id column to VARCHAR and store a PHP payload that a later unsanitized eval() executes every time any page - including unauthenticated and low-privilege ones - instantiates CategoryTree, turning a one-time admin action into a persistent server-wide backdoor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated OpenEMR administrator account (or equivalent ability to run arbitrary SQL), consistent with CVSS PR:H, plus the target running OpenEMR 8.2.0 or earlier with the standard Tree.class.php/CategoryTree component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, score 9.4) reflects network-reachable, low-complexity exploitation that nonetheless requires high privileges (PR:H) - an administrator account - while producing full confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained OpenEMR administrator credentials (via phishing, credential reuse, or a chained lower-severity flaw) uses the admin-accessible SQL execution path to alter the categories table id column to VARCHAR and insert a PHP web-shell payload. On the next request to any page that instantiates CategoryTree - including pages reachable without authentication - the unsanitized eval() runs the payload, giving the attacker command execution as the web server user. … |
| Remediation | Upgrade to a fixed OpenEMR release above 8.2.0 once available; the source data does not include an exact patched version, so no vendor-released fix version is independently confirmed at time of analysis - track the VulnCheck advisory (https://www.vulncheck.com/advisories/openemr-remote-code-execution-via-categorytree-eval-injection) and the OpenEMR project for the tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all OpenEMR installations running versions 8.2.0 or earlier and immediately restrict administrative access to document category and tree management functions to essential personnel only; verify no unexpected modifications to the categories table have occurred. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today