CVE-2026-39932 Details
Description
OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user.
A remote code execution vulnerability has been identified in OpenEMR versions through 8.2.0, specifically within the document category tree component. This vulnerability allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. The issue arises because the 'id' column in the categories table, normally an integer, can be altered to accept strings. Once a PHP payload is inserted, it is executed through an unsanitized eval() call whenever the CategoryTree is instantiated, including on unauthenticated and low-privilege pages, resulting in command execution as the web server user.
Users can upgrade to OpenEMR version 8.3.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the OpenEMR documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jivasecurity.com/writeups/openemr-eval-rce-category-tree-cve-2026-39932 | [email protected] | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/openemr-remote-code-execution-via-categorytree-eval-injection | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| open-emr openemr | < 8.2.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | New CVE Received | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |