OpenCATS: Authenticated remote code execution via staged import file upload
Summary
OpenCATS before 0.10.0 allows an authenticated user with Import privileges to upload a PHP file through the Import module that keeps an attacker-chosen executable filename in the web-accessible temporary directory. If that directory runs PHP, requesting the staged file executes arbitrary code with web server privileges, which can expose or modify recruiting data and the host system. The CVSS base score of 9.1 is from the CVE record; the NVD status is Deferred.
Affected
- OpenCATS versions before 0.10.0
- Exposure depends on the web server executing PHP in the temporary upload directory
Fixed in
- Upgrade to OpenCATS 0.10.0 or later
Workaround
- Make sure the temporary upload directory (CATS_TEMP_DIR) cannot execute PHP or other server-side scripts
- Restrict Import privileges to a small number of trusted users
- Whether default installations or common web server configurations leave the temporary directory executable is unknown.
Exploitation
- No evidence of active exploitation found; the CVE is not listed in CISA KEV.
- No public proof-of-concept found, but this has not been exhaustively checked.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Upgrade all OpenCATS instances to version 0.10.0 or later.
- Until the upgrade is done, verify that the temporary upload directory does not execute PHP and restrict Import rights.
- Review user accounts with Import privileges and check the temporary directory for unexpected PHP files.
- Prioritise this for internet-reachable instances, as candidate personal data may be exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v9gx-5qhj-jf7c github.com
- OpenCATS release v0.10.0 github.com
- Fix commit 7f15174 github.com
- Pull request #808 github.com
- OSV record CVE-2026-54454 osv.dev
- VulDB entry 417799 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:46.
Original description (NVD)
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.