CVE-2026-54454: OpenCATS: Authenticated RCE in the Import module
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCATSto a version that resolves this vulnerability.Fixed in 0.10.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenCATS user must have Import privileges. Exploitation also depends on the attacker being able to use the affected import data path and upload a PHP file.
Are all OpenCATS deployments affected by default?
Code execution requires the web-accessible temporary directory to allow PHP execution. If that directory is not served by the web server or PHP execution is disabled there, the described execution path is not available.
What conditions make exploitation successful?
The uploaded PHP file must retain an attacker-controlled executable filename in the temporary directory, and an import error must leave the file on disk. The attacker can then request the staged file if the temporary directory is web accessible and executes PHP.
What can be done before upgrading?
Restrict Import privileges to trusted users and prevent PHP execution in the web-accessible temporary directory. Limiting web access to that directory also disrupts the described request-based execution step.
How can administrators determine whether they are affected?
OpenCATS versions prior to 0.10.0 are affected by the vulnerable Import module behavior. Review whether users have Import privileges and whether the temporary directory is web accessible with PHP execution enabled.