CVE-2026-39932

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.2.1

Description A remote code execution issue exists in the document category tree component located in library/classes/Tree.class.php. Authenticated administrators can execute arbitrary operating system commands by injecting PHP payloads into the categories database table. This is achieved by chaining arbitrary SQL execution to change the id column type to VARCHAR and inserting a malicious payload. The payload is subsequently executed via an unsanitized eval() function whenever any page instantiates CategoryTree, which includes pages accessible to unauthenticated or low-privilege users, leading to command execution with the privileges of the web server user.

Recommendations Update to version 8.2.1 or later.