CVE-2026-54454 in OpenCATS
Summary
by MITRE • 10/13/2026
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
OpenCATS serves as an open-source applicant tracking system designed to manage recruitment workflows for staffing agencies and hiring teams. A critical security vulnerability was identified within the Import module, specifically located in the modules/import/ImportUI.php file of versions prior to 0.10.0. This flaw stems from improper handling of uploaded files during data import operations. The application preserves the original filename provided by the user for one specific type of import data and stores these files in a temporary directory that is accessible via the web server. This architectural decision creates a significant security gap when combined with insufficient validation mechanisms, allowing authenticated users with Import privileges to exploit this behavior through crafted inputs.
The technical flaw involves a lack of strict filename sanitization and extension filtering during the file upload process. An attacker who has obtained valid credentials and possesses import permissions can select the affected import path and upload a malicious PHP script disguised as a legitimate data file. Because the system retains the original name, the uploaded payload is saved with an executable .php extension rather than being renamed to a random string or stored in a non-executable location. Furthermore, if the import operation encounters an error during processing, the temporary file may not be automatically cleaned up and remains on disk. This persistence ensures that even after a failed attempt, the malicious artifact stays available for subsequent exploitation attempts without requiring repeated uploads.
The operational impact of this vulnerability is severe, as it leads to Remote Code Execution (RCE) under specific server configurations. If the temporary directory where these files are stored has PHP execution enabled, an attacker can simply request the URL corresponding to the staged file. This action triggers the web server to interpret and execute the malicious code with the privileges of the web server process. Consequently, this grants the attacker full control over the application environment, allowing them to exfiltrate sensitive recruiting data such as candidate resumes and personal information, modify system configurations, or pivot further into the internal network. The vulnerability aligns with CWE-434, which describes the unrestricted upload of files with dangerous types, and is categorized under MITRE ATT&CK technique T1505.003, known as Web Shell: Cloud Services, although in this context it applies to on-premise or standard web hosting environments where temporary directories are executable.
To mitigate this risk, organizations running OpenCATS versions prior to 0.10.0 must upgrade immediately to version 0.10.0 or later, which addresses the underlying code flaws responsible for preserving dangerous filenames and improper file storage practices. For systems that cannot be upgraded instantly, administrators should ensure that any temporary directories used by the application are configured with execute permissions disabled at the web server level. Additionally implementing strict allowlists for allowed file extensions during upload processes and ensuring that uploaded files are moved to non-web-accessible locations or renamed with random strings can significantly reduce the attack surface. Regular auditing of uploaded content and enforcing strong authentication policies further hardens the environment against unauthorized access attempts.