CVE-2026-39931
Received Received - Intake

Authenticated SQL Injection in OpenEMR via Backup Import

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure_file_priv settings are configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-39931
EUVD
EUVD-2026-52342

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr 8.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR through version 8.2.0 has an authenticated SQL injection flaw in the backup configuration import feature. Administrators with admin or super ACL privileges can upload a malicious SQL file via the form_step=202 parameter in backup.php. This allows them to execute arbitrary database commands, including DDL and DML statements, by exploiting unfiltered shell_exec calls to the mysql command-line client.

Detection Guidance

To detect this vulnerability, check for unauthorized SQL file uploads in backup.php with form_step=202. Review MySQL logs for unusual DDL/DML commands or shell_exec invocations of mysql. Inspect access control tables for unexpected modifications or new accounts.

Impact Analysis

An attacker with admin or super ACL privileges could extract sensitive credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, or write arbitrary files to the filesystem if MySQL FILE privileges and permissive secure_file_priv settings are enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security and privacy rules. It may result in data breaches, unauthorized modifications, or exposure of protected health information, leading to legal penalties and compliance failures.

Mitigation Strategies

Immediately update OpenEMR to the latest version. Restrict admin and super ACL privileges to only necessary users. Disable shell_exec for MySQL processes. Set secure_file_priv to restrict file writes. Monitor database logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart