CVE-2026-27760: OpenCATS PHP Code Injection via installer AJAX endpoint
OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCATSto a version that resolves this vulnerability.Patch 3002a29
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27760?
CVE-2026-27760 is classified as a high severity vulnerability due to its potential for code execution.
How do I fix CVE-2026-27760?
To fix CVE-2026-27760, upgrade OpenCATS to version 3002a29 or later.
Who is affected by CVE-2026-27760?
The vulnerability affects all versions of OpenCATS prior to commit 3002a29.
What are the consequences of exploiting CVE-2026-27760?
Exploiting CVE-2026-27760 allows unauthenticated attackers to execute arbitrary PHP code.
What action should I take if I can't upgrade due to CVE-2026-27760?
If an upgrade is not possible, apply security measures by restricting access to the installer AJAX endpoint to trusted networks.