CVE-2026-32238

Опубликовано: 19 мар. 2026

Источник: nvd

CVSS3: 9.1

EPSS Низкий

Описание

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.

Ссылки

https://github.com/openemr/openemr/commit/7bc7bd077a624e205daed17658de41af6070ef73
Patch
https://github.com/openemr/openemr/security/advisories/GHSA-6pmc-3xm7-pm86
Exploit
Mitigation
Vendor Advisory
https://github.com/openemr/openemr/security/advisories/GHSA-6pmc-3xm7-pm86
Exploit
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*

Версия до 8.0.0.2 (исключая)

EPSS

Процентиль: 77%

0.01889

Низкий

9.1 Critical

CVSS3

Дефекты

CWE-78

Связанные уязвимости

BDU:2026-05089