CVE-2026-33914: OpenEMR has SQL Injection in PostCalendar Category Delete
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the categoriesUpdate administrative function. The dels POST parameter is read via pnVarCleanFromInput(), which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL DELETE statement that is executed unsanitized via Doctrine DBAL's executeStatement(). Version 8.0.0.3 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33914?
CVE-2026-33914 is classified as a high severity vulnerability due to its potential for exploitation through SQL injection.
How do I fix CVE-2026-33914?
To fix CVE-2026-33914, upgrade OpenEMR to version 8.0.0.3 or later to eliminate the blind SQL injection vulnerability.
Who is affected by CVE-2026-33914?
CVE-2026-33914 affects all versions of OpenEMR prior to 8.0.0.3 that use the PostCalendar module.
What type of vulnerability is CVE-2026-33914?
CVE-2026-33914 is an SQL injection vulnerability located in the categoriesUpdate function of the PostCalendar module.
Is CVE-2026-33914 critical for data security?
Yes, CVE-2026-33914 poses a critical risk as it allows attackers to execute arbitrary SQL queries, compromising the database integrity.