A critical security flaw has been found in OpenEMR, a popular open-source electronic medical records platform, affecting all versions up to 8.2.0. The flaw exists in the software's document category organization feature, which is used to sort and manage stored files and records.
The vulnerability allows users with full administrator access to the OpenEMR system to insert harmful code into the software's category settings. Attackers can also chain this flaw with an SQL injection issue to modify the software's database structure and store the malicious code in a way the software will automatically run.
Once the harmful code is stored, it executes any time the software loads its category list, which occurs on both public-facing pages and pages for users with limited access, including pages that do not require a login. The code runs with the same permissions as the web server hosting the OpenEMR instance, allowing attackers to run arbitrary operating system commands on that server.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-39932
