CVE-2026-54454
Deferred Deferred - Pending Action

Arbitrary PHP Code Execution in OpenCATS Import Module

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-54454
EUVD
EUVD-2026-98922

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opencats OpenCATS < 0.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenCATS before 0.10.0 has a flaw in the Import module where an authenticated user with Import privileges can upload a PHP file disguised with a preserved original filename. The file is placed in a web-accessible temporary directory. If PHP execution is enabled in this directory, the attacker can execute arbitrary PHP code with the web server's privileges by requesting the file after an import error leaves it on disk.

Detection Guidance

Check for unexpected PHP files in the web-accessible temporary directory used by OpenCATS. Look for files with unusual names or recent timestamps in the import module directory. Review server access logs for suspicious requests to PHP files in temporary directories.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code on the server hosting OpenCATS. This could lead to unauthorized access to sensitive recruiting data, modification or deletion of data, and potential compromise of the host system. The impact includes data breaches, system takeovers, and disruption of recruitment operations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access or exposure of personal data. GDPR requires protection of personal data and breach notification, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, triggering legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade OpenCATS to version 0.10.0 or later immediately. Disable PHP execution in the web-accessible temporary directory. Remove any unauthorized PHP files found in the temporary or import directories. Restrict Import module privileges to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54454. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart