OpenEMR CategoryTree eval() Remote Code Execution

Technical Analysis

CVE-2026-39932 stems from unsafe use of eval() in library/classes/Tree.class.php, where data from the categories table's id column is executed as PHP code rather than being treated as a data value. An authenticated admin can first alter the id column type to VARCHAR via SQL injection or direct database manipulation, then insert a crafted PHP payload as a category id; when any page later instantiates CategoryTree (including public-facing or low-privilege pages), the payload executes with web server privileges. This chain effectively converts an admin-tier weakness into an unauthenticated RCE vector, making it highly exploitable in shared or multi-tenant OpenEMR deployments. Given a CVSS score of 9.1, successful exploitation grants attackers a foothold for lateral movement, data exfiltration (including PHI), or deployment of secondary payloads such as web shells or ransomware. Organizations that run OpenEMR instances alongside AI agents or RAG-based clinical assistants that query patient records through this system face a plausible agent-impact risk: compromised hosts could leak API keys, database credentials, or poisoned data ingested by downstream LLM pipelines interacting with OpenEMR data.

Affected Systems

OpenEMR versions through 8.2.0, specifically the library/classes/Tree.class.php CategoryTree component; any deployment permitting administrator-level database access or SQL injection into the categories table.

Indicators of Compromise

• Tree.class.php (modified/anomalous eval() calls)
• Unexpected VARCHAR type change on categories.id column
• Suspicious PHP payload strings embedded in categories table id field
• Unusual web server process spawning shell commands (e.g., sh, bash, cmd.exe) from PHP-FPM/Apache worker processes

Remediation Steps

1. 1

   Apply vendor patch

   Upgrade OpenEMR to the latest patched release that addresses CVE-2026-39932 and removes or sanitizes eval() usage in Tree.class.php.

2. 2

   Audit categories table schema and content

   Check the categories table id column type and contents for unauthorized VARCHAR conversion or embedded PHP code; restore from a known-good backup if compromise is suspected.

3. 3

   Restrict administrative access

   Limit and monitor accounts with administrator privileges, enforce MFA, and review audit logs for unusual database schema changes.

4. 4

   Web application firewall rules

   Deploy WAF rules to detect and block SQL injection attempts targeting the categories table and anomalous requests to CategoryTree-invoking endpoints.

5. 5

   Harden PHP execution environment

   Disable or restrict eval() usage where possible, apply least-privilege permissions to the web server process, and enable PHP security modules (e.g., disable_functions, open_basedir).

6. 6

   Rotate credentials and secrets

   Rotate database credentials, API keys, and any secrets accessible from the web server environment, especially if agent or automation systems interact with OpenEMR data.