CVE-2026-39931: OpenEMR Authenticated SQL Injection via backup.php Import Feature
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the formstep=202 parameter in backup.php. Attackers can exploit the unfiltered shellexec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive securefilepriv settings are configured.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39931?
The severity of CVE-2026-39931 is classified as high with a score of 7.2.
How do I fix CVE-2026-39931?
To fix CVE-2026-39931, ensure that user file upload capabilities are restricted and validate any SQL files being imported.
Who is affected by CVE-2026-39931?
CVE-2026-39931 affects OpenEMR users with admin or super ACL privileges allowing them to exploit the SQL injection vulnerability.
What type of vulnerability is CVE-2026-39931?
CVE-2026-39931 is an authenticated SQL injection vulnerability affecting the backup configuration import feature of OpenEMR.
Can CVE-2026-39931 lead to data compromise?
Yes, CVE-2026-39931 can lead to data compromise as it allows execution of arbitrary SQL statements against the application database.