by Kastro
Paper/Archive/CVE-2026-32238

CVE-2026-32238

openemr openemr — OpenEMR has Remote Code Execution in backup functionality

EPSS 2%public exploitCVSS 9.1
critical.is priorityof 100
53
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 80.3.803 × 2016.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.

Affected

ProductAffectedFixed inSource
openemr< 8.0.0.2–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/openemr/openemr/security/advisories/GHSA-6pmc-3xm7-pm86refgithub.com/openemr/openemr/commit/7bc7bd077a624e205daed17658de41af6070ef73