Read the docs
TI-2026-71906 Aliases CVE-2026-54454

Unrestricted file upload in OpenCATS enables remote code execution

Priority MEDIUM 41CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

OpenCATS before 0.10.0 is affected. The Import module keeps an uploaded file's original name and stores it in the web-accessible temporary directory, a flaw that lets users upload files without checking their type (CWE-434). An authenticated user with Import privileges can upload a PHP file under an executable name, and if PHP runs in that directory, requesting it executes arbitrary PHP code with web server privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 34th percentileScored 2026-11-07
Fix Fixed OpenCATS (opencats): 0.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opencatsOpenCATSbefore 0.10.00.10.0Patch availableCNA
  • OpenCATS Vendoropencats Affected before 0.10.0 Fixed in 0.10.0 Patch available CNA

Remediation

Upgrade OpenCATS to version 0.10.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA OpenCATS (opencats) Fixed in 0.10.0

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-54454
  2. 2026-10-13 CISA SSVC decision points changed
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-14 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2021-22549 OpenCATS 0.9.4 Remote Code Execution via Resume Upload CVSS 4.0CRITICAL 9.3
  • TI-2026-22120 OpenCATS PHP Code Injection via installer AJAX endpoint CVSS 4.0CRITICAL 9.2
  • TI-2026-36639 OpenCATS - SQL Injection in DataGrid sortDirection Parameter CVSS 4.0HIGH 8.4
  • TI-2023-12031 Cross-site scripting in OpenCATS CVSS 3.1MEDIUM 6.1
  • TI-2023-12032 Cross-site scripting in OpenCATS CVSS 3.1MEDIUM 5.4
  • TI-2023-12030 Open redirect in OpenCATS CVSS 3.1MEDIUM 5.4
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences