CVE-2021-47817: OpenEMR 5.0.2.1 - Remote Code Execution

Published Jan 21, 2026

Updated

OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file upload to achieve remote code execution. Attackers can exploit the vulnerability by crafting a malicious payload to download and execute a web shell, enabling remote command execution on the vulnerable OpenEMR instance.

Affected Software

2 affected components

OpenEMR OpenEMR

open-emr Openemr=5.0.2.1

Remediation

Patch Available

https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability?utm_medium=cpc&utm_source=twitter&utm_campaign=openemr&utm_term=security&utm_content=tofu

Event History

Jan 21, 2026

CVE Published

via MITRE·05:27 PM

Data Sourced

via MITRE·05:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Dec 8, 58362

Event

via NVD·02:03 AM

Frequently Asked Questions

What is the severity of CVE-2021-47817?

CVE-2021-47817 is classified as a high severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2021-47817?

To fix CVE-2021-47817, upgrade OpenEMR to the latest version that has patched this vulnerability.

What types of attacks can exploit CVE-2021-47817?

CVE-2021-47817 can be exploited by authenticated attackers using cross-site scripting techniques to inject malicious JavaScript.

Is CVE-2021-47817 easily exploitable?

Yes, CVE-2021-47817 is easily exploitable if an attacker has access to an authenticated user account.

What can happen if CVE-2021-47817 is successfully exploited?

If successfully exploited, CVE-2021-47817 could allow attackers to execute arbitrary code on the affected system.