Loading vulnerability…
Remote Code Execution in OpenEMR CategoryTree
CVE-2026-39932 is a critical remote code execution vulnerability affecting OpenEMR through version 8.2.0. The flaw is in the document category tree component, specifically library/classes/Tree.class.php, where CategoryTree processing uses an unsanitized eval() call on attacker-controlled data derived from the categories database table. An authenticated administrator can exploit the issue by chaining arbitrary SQL execution to modify the schema of the categories table so that the id column can store a crafted PHP payload, then inserting that payload into the table. Once stored, the payload is executed whenever any page instantiates CategoryTree, including pages accessible to unauthenticated or low-privilege users. This results in execution of arbitrary operating system commands in the context of the web server process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary operating system command execution on the affected OpenEMR server with the privileges of the web server user. Because the malicious payload is persisted in the database and triggered whenever CategoryTree is instantiated, the vulnerability can provide durable server-side code execution, facilitate compromise of application data, enable further post-exploitation activity from the web application context, and expose even unauthenticated or low-privilege application paths as execution triggers after the payload has been planted.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict and closely monitor administrative access, investigate and block any avenue that permits arbitrary SQL execution against the application database, and monitor for unexpected schema changes or suspicious data in the categories table. Additional defensive measures include heightened monitoring for anomalous web server child processes or command execution, limiting the privileges of the web server account, and reducing exposure of OpenEMR instances until the fixed release is deployed.
Patch, then assume compromise.
Upgrade OpenEMR to version 8.2.1 or later. In addition to patching, review the integrity of the categories table and related schema for unauthorized modifications, remove any injected PHP payloads or malicious records, and investigate whether administrative access or arbitrary SQL execution was abused prior to remediation. Affected deployments should also review input handling around database-backed tree data and reassess administrative privilege assignments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.