Critical OpenEMR RCE Lets Database Payloads Trigger PHP Code Execution

A critical remote code execution flaw, tracked as CVE-2026-39932, affects OpenEMR through version 8.2.0 and stems from an unsafe eval() call in the document category tree component, specifically library/classes/Tree.class.php. The bug allows attacker-controlled PHP code stored in the categories database table to be executed when the application instantiates CategoryTree, turning a database-level compromise into code execution on the server. The issue has been rated 9.4 (CVSS 4.0) and 9.1 (CVSS 3.1).

Public reporting says an authenticated administrator can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then triggered by both authenticated and unauthenticated page activity that loads the category tree. Successful exploitation can lead to operating system command execution as the web server user. Defenders are advised to upgrade to OpenEMR 8.2.1 or later and review database integrity, input sanitization, administrative access, and signs of unauthorized command execution.