OpenEMR (<= 8.2.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openemr--8.2.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 03 Aug 2026 18:05:37 +0000Remote Code Execution in OpenEMR Document Category Treehttps://feed.craftedsignal.io/briefs/2026-08-openemr-rce/Mon, 03 Aug 2026 18:05:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-openemr-rce/OpenEMR versions 8.2.0 and earlier are vulnerable to authenticated remote code execution via SQL injection and unsafe eval() calls in the document category tree component.OpenEMR versions up to and including 8.2.0 contain a critical remote code execution vulnerability located within the document category tree component, specifically in the library/classes/Tree.class.php file. The vulnerability stems from an insecure implementation that allows an authenticated administrator to inject arbitrary PHP payloads into the categories database table. By leveraging SQL injection to alter the id column type to VARCHAR, an attacker can insert a malicious payload. This payload is subsequently executed via an unsanitized eval() function call whenever the CategoryTree component is instantiated. Because this component is used across various parts of the application, including pages accessible to unauthenticated users or those with low privileges, a successful exploit results in arbitrary command execution under the context of the web server user. This vulnerability requires administrative access to initiate, but the impact extends to full system compromise from the web server's privilege level.

Attack Chain

  1. Attacker authenticates to the OpenEMR instance with administrative privileges.
  2. Attacker interacts with the document category tree management interface.
  3. Attacker executes a crafted SQL injection payload to alter the schema of the categories database table, changing the id column type to VARCHAR.
  4. Attacker inserts a malicious PHP code snippet as a record into the categories table.
  5. Attacker triggers the vulnerability by navigating to a page (including unauthenticated endpoints) that invokes the CategoryTree class.
  6. The application performs an unsanitized eval() call on the injected database content.
  7. The web server process executes the attacker-supplied PHP payload.
  8. Attacker achieves remote code execution as the web server user for further post-exploitation activity.

Impact

Successful exploitation allows for full remote command execution on the host running the OpenEMR instance. This compromises the integrity and confidentiality of the electronic medical records data stored within the application and grants the attacker a foothold on the internal network segment hosting the web server.

Recommendation

  1. Upgrade all OpenEMR instances to the latest secure version addressing this vulnerability.
  2. Implement strict administrative access controls to limit the number of users capable of modifying database-driven configurations.
  3. Monitor web server logs for suspicious database query patterns, specifically those attempting to alter schema definitions or modify core application tables.
  4. Perform code review or implement file integrity monitoring on library/classes/Tree.class.php to detect unauthorized modifications.
]]>highadvisoryweb-application-vulnerabilityremote-code-executionhealthcarecve-2026-39931sql-injectionweb-applicationvulnerabilityauthentication-bypassfhir