CVE-2026-54454 Details
Description
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.
A remote code execution vulnerability has been identified in the OpenCATS applicant tracking system, specifically in versions prior to 0.10.0. The issue resides in the Import module, where uploaded files could retain their original names and be placed in a web-accessible temporary directory. An authenticated user with Import privileges could exploit this by uploading a PHP file that, if an import error occurred, would be left on the server. If the temporary directory allowed PHP execution, this could lead to arbitrary code execution with the web server's privileges, potentially compromising recruitment data and the host system.
Users are advised to upgrade to OpenCATS version 0.10.0 or later. After upgrading, ensure that temporary upload directories are not set to execute PHP or other server-side scripts. As a temporary measure, access to the Import module can be restricted to trusted administrative users until the upgrade is complete.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opencats/OpenCATS/commit/7f151741598c36c8233ada4b6b64f12b721d4907 | [email protected] | Source CodeVendor |
| https://github.com/opencats/OpenCATS/pull/808 | [email protected] | Source CodeVendor |
| https://github.com/opencats/OpenCATS/releases/tag/v0.10.0 | [email protected] | Release NotesVendor |
| https://github.com/opencats/OpenCATS/security/advisories/GHSA-v9gx-5qhj-jf7c | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenCATS | <= 0.9.7.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |