CVE-2026-115513: OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCATSto a version that resolves this vulnerability.Fixed in 0.12.0
Event History
Frequently Asked Questions
Who can exploit this issue and who is at greatest risk?
Any authenticated user with low privileges who can set the name or title of a Candidate, Company, Contact, Job Order, or List can inject the payload. Users who subsequently view the affected Recent navigation panel are exposed, with Site Administrators at particular risk because their session can be used to gain administrative control.
Does exploitation require a victim to open a specific malicious record?
No. The malicious value is rendered in the Recent (MRU) navigation panel, which is displayed on nearly every page. An attacker needs to create or rename a supported record and have another user view a page where that stored entry appears in the panel.
Which configurations are affected?
The issue affects OpenCATS versions before 0.12.0. It is triggered through normal authenticated record naming or title fields and does not depend on a special optional feature described in the available data.
What is the available remediation?
Upgrade to OpenCATS 0.12.0 or later. The referenced fix updates the MRU rendering path in lib/MRU.php.