CVE-2026-32238: OpenEMR has Remote Code Execution in backup functionality
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.0.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32238?
CVE-2026-32238 has been rated as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-32238?
To fix CVE-2026-32238, upgrade OpenEMR to version 8.0.0.2 or later.
What type of vulnerability is CVE-2026-32238?
CVE-2026-32238 is classified as a remote code execution vulnerability due to command injection in the backup functionality.
Who is affected by CVE-2026-32238?
CVE-2026-32238 affects all versions of OpenEMR prior to 8.0.0.2.
What can attackers do with CVE-2026-32238?
Attackers can exploit CVE-2026-32238 to execute arbitrary commands on the server if they have authenticated access.