OpenCATS: Authenticated RCE in the Import module
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.
CVE-2026-54454
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-54454
OpenCATS
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "opencats",
"product": "OpenCATS",
"versions": [
{
"status": "affected",
"version": "< 0.10.0"
}
]
}
]- Related CVEs
- CVE-2026-54454
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #21298 · Revision 1
- Added to Heist Feed
- Publisher date