CVE-2026-39931

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.2.1

Description An authenticated SQL injection exists in the backup configuration import feature. Administrators with admin or super ACL privileges can execute arbitrary Data Definition Language (DDL) and Data Manipulation Language (DML) statements against the application database. This is achieved by uploading a crafted SQL file via the form step=202 parameter in the 'backup.php' endpoint. The issue stems from an unfiltered shell exec() invocation of the mysql command-line client, which can be used to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem if MySQL FILE privileges and permissive secure file priv settings are configured.

Recommendations Update to version 8.2.1 or later. Restrict access to the 'backup.php' endpoint to only the most trusted administrators. Configure the secure file priv setting in MySQL to a restrictive value to prevent arbitrary file writes.