Key points
- CVE-2026-54454 affects OpenCATS versions prior to 0.10.0.
- The vulnerability requires an authenticated account with Import privileges.
- The issue is rated CVSS 9.1 Critical by the National Vulnerability Database.
An attacker with valid credentials and Import privileges can execute arbitrary PHP code on OpenCATS servers. This critical remote code execution flaw, tracked as CVE-2026-54454, allows adversaries to compromise the host system and access recruiting data. The National Vulnerability Database rates the severity as 9.1, classifying it as Critical due to the potential for full system control.
The flaw exists in the Import module’s file handling logic within modules/import/ImportUI.php. Before version 0.10.0, the system preserves the original filename of uploaded files for certain data types. It places these files in a web-accessible temporary directory. If the server is configured to execute PHP in that directory, the staged file becomes a potent weapon for an attacker.
Context of the flaw
OpenCATS is an open-source applicant tracking system used by staffing agencies and hiring teams. The security issue stems from how the application manages temporary files during the import process. An import error can leave the malicious file on the disk. Requesting this file via a web browser triggers the execution of the embedded PHP code with the privileges of the web server process.
Who is affected
Any organisation running OpenCATS versions older than 0.10.0 is exposed to this risk. The attacker must possess an authenticated user account that has been granted Import privileges. Without these specific permissions, the exploit path described in the advisory is not viable. The vulnerability does not affect version 0.10.0 or later releases.
What happens next
The vendor has released version 0.10.0, which fixes this issue. Administrators should upgrade their instances immediately to mitigate the risk. Until the update is applied, the system remains vulnerable to exploitation by any user with Import rights. Monitoring access logs for unusual file uploads in temporary directories can help detect ongoing abuse.
Why this attack works
This incident illustrates the dangers of inadequate file sanitisation in web applications. When systems store user-supplied files in directories that serve executable content, they create a direct path to code execution. Teams usually validate file extensions and rename uploads to prevent this. Checking whether temporary storage areas are excluded from execution policies helps reduce exposure. Ensuring strict access controls on upload functions limits the blast radius of such mistakes.
What to do and how to stay safe: OpenCATS
- Upgrade OpenCATS installations to version 0.10.0 or later as soon as possible.
- Audit user accounts to ensure only authorised personnel have Import privileges.
- Configure web servers to disable PHP execution in temporary and upload directories.
- Monitor server logs for attempts to access files with executable extensions in temp folders.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-54454?
The National Vulnerability Database assigns a CVSS score of 9.1, rating it as Critical.
Which versions of OpenCATS are vulnerable?
All versions of OpenCATS prior to 0.10.0 are affected by this vulnerability.
Does the attacker need to be logged in to exploit this?
Yes, the attacker must have an authenticated account with Import privileges.
