The vulnerability is a command injection flaw in the backup feature of OpenEMR. Because inputs are not properly validated, an attacker who can authenticate to the system can supply arbitrary commands that the server will execute. This allows the attacker to take full control of the host, compromising confidentiality, integrity, and availability of the entire electronic health record environment.

OpenEMR products before version 8.0.0.2 are affected. The vulnerability exists in all releases prior to the referenced fix, and affects installations of the openemr application regardless of deployment size or geography.

The CVSS score is 9.1, indicating high severity and a high likelihood of damaging exploitation. The EPSS score is below 1%, suggesting that active exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog, but the combination of remote command execution with required authentication means that only users with legitimate access can abuse the flaw. An internal attacker or a compromised legitimate user can trigger the exploit through the backup functionality. The exploit path requires that the user have permission to access the backup interface and that the application is running a vulnerable version before 8.0.0.2.