CVE-2021-47936: OpenCATS 0.9.4 Remote Code Execution via Resume Upload

Published May 10, 2026

Updated

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and execute system commands via POST requests to the uploaded file in the upload directory.

Affected Software

1 affected component

OpenCATS OpenCATS=0.9.4

Event History

May 10, 2026

CVE Published

via MITRE·12:43 PM

Data Sourced

via MITRE·12:43 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-47936?

CVE-2021-47936 is classified as a critical severity vulnerability allowing remote code execution.

How do I fix CVE-2021-47936?

To fix CVE-2021-47936, upgrade OpenCATS to the latest version or apply any available patches.

What type of attacks can CVE-2021-47936 facilitate?

CVE-2021-47936 can facilitate remote code execution attacks through malicious file uploads.

Who is affected by CVE-2021-47936?

CVE-2021-47936 affects all users of OpenCATS version 0.9.4.

Can CVE-2021-47936 be exploited without authentication?

Yes, CVE-2021-47936 can be exploited by unauthenticated attackers.