The vulnerability (CVE-2026-39931) affects OpenEMR through version 8.2.0 and involves an authenticated SQL injection in the backup configuration import feature. Administrators can exploit this by uploading a malicious SQL file via the form_step=202 parameter in backup.php. The vulnerability arises from unfiltered use of shell_exec to invoke the mysql command-line client, enabling execution of arbitrary DDL and DML statements. Potential impacts include extraction of credential hashes, modification of access control tables, injection of backdoor accounts, creation of persistent triggers or stored procedures, and arbitrary file writes to the filesystem when MySQL FILE privileges and permissive secure_file_priv settings are configured.

Successful exploitation allows attackers with administrative privileges to execute arbitrary SQL commands, compromising confidentiality, integrity, and availability of the OpenEMR database. This includes stealing credential hashes, altering access controls, injecting persistent backdoors, and writing files to the server filesystem under certain MySQL configurations. The vulnerability has a CVSS score of 7.2 (high severity), indicating significant impact on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and review MySQL FILE privilege and secure_file_priv settings to limit potential damage. Monitor vendor channels for updates and apply official patches once released.