CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature
Administrators can execute arbitrary SQL commands and potentially write files via a crafted import in OpenEMR's backup feature.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39931?
CVE-2026-39931 is a high-severity SQL injection vulnerability in Open-Emr Openemr, published on 3 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure_file_priv settings are configured.
Weakness: CWE-434
Which versions are affected by CVE-2026-39931?
It affects 1 product.
Products include Open-Emr Openemr.
How do I fix CVE-2026-39931?
No fix has been published for CVE-2026-39931 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-39931 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39931 exists.
Other vulnerabilities in Open-Emr Openemr
- CVE-2026-24898 OpenEMR has an Unauthenticated MedEx Token Disclosure
- CVE-2026-24849 OpenEMR Arbitrary File Read Vulnerability
- CVE-2026-24908 OpenEMR has SQL Injection in Patient API Sort Parameter
- CVE-2022-2734 Improper Restriction of Rendered UI Layers or Frames in openemr/openemr
- CVE-2024-22611 SQL injection in n/a
Sources
Also known as GHSA-v687-rxcc-g864.