CVE-2026-54453: OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI (manageProfessional) accepts administrator-controlled license key input that is reconstructed into a PHP define() statement in config.php without safe escaping. Because the application includes config.php, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges. An authenticated administrator must have Settings module access and permission to update Professional License configuration, and config.php must be writable for this write-based path. Successful exploitation can read, modify or delete application data, expose candidate, contact, company, job order and user account information, alter the installation or configuration, and provide a foothold for further attacks. Unauthenticated exploitation and exploitation without Settings access are not established. This issue is fixed in version 0.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCATSto a version that resolves this vulnerability.Fixed in 0.10.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator needs access to the Settings module and permission to update the Professional License configuration. Unauthenticated exploitation and exploitation by users without Settings access are not established.
What conditions are required for the vulnerable write path?
The attacker must be able to supply a crafted Professional License key through SettingsUI (manageProfessional), and config.php must be writable. The injected PHP executes persistently when the application includes config.php, with the web server process privileges.
Are default deployments affected?
The available information does not establish whether config.php is writable in a default deployment. Exposure depends on both use of a version before 0.10.0 and the administrator permissions and file-write condition described.
How can I remediate the issue?
Upgrade OpenCATS to version 0.10.0, which fixes the issue. If upgrading cannot happen immediately, restrict access to the Settings module and Professional License configuration, and ensure config.php is not writable through this application path.
How can I check for possible compromise?
Review Professional License configuration values for unexpected or crafted content and inspect config.php for altered PHP syntax or unexpected definitions. Because execution occurs when config.php is included, investigate the web server process context for signs of unauthorized activity.