CVE-2026-32238 Details
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.
A command injection vulnerability allowing remote code execution has been identified in OpenEMR versions prior to 8.0.0.2. This vulnerability arises from inadequate input validation in the backup feature, where user-supplied data is concatenated into shell commands without proper sanitization. Authenticated attackers can exploit this flaw by injecting malicious commands that are executed on the server.
Users are advised to update OpenEMR to version 8.0.0.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openemr/openemr/security/advisories/GHSA-6pmc-3xm7-pm86 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/openemr/openemr/commit/7bc7bd077a624e205daed17658de41af6070ef73 | [email protected] | Patch |
| https://github.com/openemr/openemr/security/advisories/GHSA-6pmc-3xm7-pm86 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| open-emr openemr | < 8.0.0.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |