CVE-2026-39932 is a critical code injection flaw (CVSS 9.1) in OpenEMR through version 8.2.0. The document category tree passes database content to an unsanitized eval(), so an authenticated administrator can reach command execution as the web server user. No fixed version is confirmed.
What's affected
OpenEMR through 8.2.0 is affected. The VulnCheck advisory I checked says the affected range remains undefined and states no fixed version, vendor fix or workaround.
The flaw is in library/classes/Tree.class.php. Check the OpenEMR project for a release that addresses it.
How to check if you're exposed
Find your version in the OpenEMR About page, or in the version file in the web root. Then see whether the file is present:
grep -n "eval" library/classes/Tree.class.php
Review who holds administrator accounts and whether they use multi-factor authentication.
What to do now
- Confirm your OpenEMR version and check the project for a fixed release.
- Limit administrator accounts and protect them with strong, unique credentials.
- Restrict database access so that SQL execution is not available to application users beyond what is needed.
- Monitor for unexpected changes to the categories table.
- Run the web server with minimal operating system privileges.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-95 (Eval Injection), where data is evaluated as code. The advisory says the id column of the categories table can be altered and filled with PHP, which then runs whenever any page instantiates CategoryTree, including unauthenticated or low privilege pages.
The vector requires high privileges (PR:H), which lowers the likelihood, but scope is changed (S:C) and the impact is full. Treat admin access as a serious boundary in a system that holds health records. The record does not flag this CVE as exploited in the wild.
Quick check
Does this need an admin account?
Yes. The advisory says the attacker must be an authenticated administrator.
Is there a fixed version?
None is confirmed in the sources I checked.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
