A "padding oracle" is an entity (usually some sort of server) that will decrypt an arbitrary message, verify whether the padding is correct, and return this information to the (arbitrary) submitter of the message. If there's no such entity in your scheme, you cannot have a padding oracle attack, as there is no padding oracle to use for the attack.
Other relevant points:
You don't specify a padding scheme that you're using. In practice the openssl command will use PKCS#5, which is a padding scheme that can be used to detect trivial tampering with the ciphertext (though it is not reliable at this), and is therefore applicable for a padding oracle attack, but other padding schemes may not have this property in which case a padding oracle couldn't even exist.
You mention an HMAC, but not how it is used. You say it's the HMAC of the ciphertext, which means the verification must also be performed against the ciphertext. In practice, this almost always means that the verification is performed before decryption. Since the HMAC will fail to verify, hopefully the ciphertext processing would halt before getting to decryption (which comes before you can check padding). In such a scenario, even if you had a padding oracle a modified message would never reach it, because it would fail at the HMAC check. (Note that HMACs of the plaintext, which of course cannot be verified until after decryption, do not have this property, are much more likely to be vulnerable to a padding oracle attack).