Summaryinfo

A vulnerability classified as critical was found in OpenEMR up to 8.0.0.2. This vulnerability affects unknown code of the component Backup Handler. The manipulation results in os command injection. This vulnerability is known as CVE-2026-32238. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in OpenEMR up to 8.0.0.2. Affected is an unknown function of the component Backup Handler. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-32238 since 03/11/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Upgrading to version 8.0.0.2 eliminates this vulnerability. Applying the patch 7bc7bd077a624e205daed17658de41af6070ef73 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-13158). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Business Process Management Software

Name

• OpenEMR

Version

• 8.0.0.0
• 8.0.0.1
• 8.0.0.2

License

• open-source

Website

• Product: https://github.com/openemr/openemr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion