CVE-2026-54454 (GCVE-0-2026-54454)
Vulnerability from cvelistv5
Published
2026-10-13 16:33
Modified
2026-10-13 20:21
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-434 - Unrestricted Upload of File with Dangerous Type
Summary
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.
References
Impacted products
Vendor Product Version
opencats OpenCATS Version: < 0.10.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T20:14:12.370077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T20:21:52.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenCATS",
          "vendor": "opencats",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file\u0027s original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T16:33:49.786Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/opencats/OpenCATS/security/advisories/GHSA-v9gx-5qhj-jf7c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/opencats/OpenCATS/security/advisories/GHSA-v9gx-5qhj-jf7c"
        },
        {
          "name": "https://github.com/opencats/OpenCATS/pull/808",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencats/OpenCATS/pull/808"
        },
        {
          "name": "https://github.com/opencats/OpenCATS/commit/7f151741598c36c8233ada4b6b64f12b721d4907",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencats/OpenCATS/commit/7f151741598c36c8233ada4b6b64f12b721d4907"
        },
        {
          "name": "https://github.com/opencats/OpenCATS/releases/tag/v0.10.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/opencats/OpenCATS/releases/tag/v0.10.0"
        }
      ],
      "source": {
        "advisory": "GHSA-v9gx-5qhj-jf7c",
        "discovery": "UNKNOWN"
      },
      "title": "OpenCATS: Authenticated RCE  in the Import module"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54454",
    "datePublished": "2026-10-13T16:33:49.786Z",
    "dateReserved": "2026-06-15T15:30:40.318Z",
    "dateUpdated": "2026-10-13T20:21:52.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54454\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-13T20:14:12.370077Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-13T20:14:13.211Z\"}}], \"cna\": {\"title\": \"OpenCATS: Authenticated RCE  in the Import module\", \"source\": {\"advisory\": \"GHSA-v9gx-5qhj-jf7c\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"opencats\", \"product\": \"OpenCATS\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.10.0\"}]}], \"references\": [{\"url\": \"https://github.com/opencats/OpenCATS/security/advisories/GHSA-v9gx-5qhj-jf7c\", \"name\": \"https://github.com/opencats/OpenCATS/security/advisories/GHSA-v9gx-5qhj-jf7c\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/opencats/OpenCATS/pull/808\", \"name\": \"https://github.com/opencats/OpenCATS/pull/808\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/opencats/OpenCATS/commit/7f151741598c36c8233ada4b6b64f12b721d4907\", \"name\": \"https://github.com/opencats/OpenCATS/commit/7f151741598c36c8233ada4b6b64f12b721d4907\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/opencats/OpenCATS/releases/tag/v0.10.0\", \"name\": \"https://github.com/opencats/OpenCATS/releases/tag/v0.10.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file\u0027s original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-434\", \"description\": \"CWE-434: Unrestricted Upload of File with Dangerous Type\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-13T16:33:49.786Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54454\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-13T20:21:52.025Z\", \"dateReserved\": \"2026-06-15T15:30:40.318Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-10-13T16:33:49.786Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.