CVE-2026-32238

9.1 criticalEPSS 2.0%

Critical (9.1) in open-emr openemr. EPSS 2.0% chance of exploitation in the next 30 days.

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-03-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

open-emr:openemr

References

https://github.com/openemr/openemr/commit/7bc7bd077a624e205daed17658de41af6070ef73
https://github.com/openemr/openemr/security/advisories/GHSA-6pmc-3xm7-pm86
https://github.com/openemr/openemr/security/advisories/GHSA-6pmc-3xm7-pm86

Check your stack JSON