OpenCATS Import Module RCE Allows Code Execution via PHP Upload

An authenticated user with Import privileges can exploit a flaw in the OpenCATS applicant tracking system to execute arbitrary code. The vulnerability exists in the Import module, specifically within the ImportUI.php file, where uploaded files are not properly sanitized before being placed in a web-accessible directory.

Root cause

The National Vulnerability Database identifies the weakness as CWE-434, involving the use of external input to select commands or arguments. In OpenCATS versions prior to 0.10.0, the application preserves the original filename of an uploaded file for one specific import data type. This behavior allows an attacker to control the executable filename stored on the server.

Attack path

An attacker with valid Import credentials selects the affected import path and uploads a PHP file. Because the system retains the attacker-controlled filename, the file remains on disk even if an import error occurs. If the temporary directory is configured to execute PHP scripts, requesting the staged file triggers arbitrary code execution with the privileges of the web server process.

Affected versions

• OpenCATS versions earlier than 0.10.0 are vulnerable.
• The issue is resolved in version 0.10.0.
• All prior releases contain the flawed Import module logic.

Mitigation

• Upgrade OpenCATS to version 0.10.0 or later immediately.
• Restrict web server configurations to prevent PHP execution in temporary directories.
• Monitor file system changes in upload directories for unexpected PHP files.
• Review user permissions to ensure only necessary accounts have Import privileges.

Detection notes

Security operations teams should monitor web server access logs for requests to temporary directories containing PHP extensions. Look for unusual file uploads by authenticated users with Import roles. Check for files created in web-accessible paths that retain original attacker-supplied names. Alert on any execution of scripts from non-standard application directories. Investigate sudden spikes in CPU usage or outbound network connections from the web server process, which may indicate remote code execution. Verify that no unexpected files persist after failed import operations.

What to do and how to stay safe: OpenCATS

• Verify your OpenCATS version and upgrade to 0.10.0 if you are running an older release.
• Audit your web server configuration to ensure temporary upload directories do not execute PHP code.
• Review user access logs for any accounts with Import privileges that have recently uploaded files.
• Monitor system integrity monitoring alerts for new files appearing in web-accessible temporary folders.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability being actively exploited in the wild?

The source material does not state whether the flaw is currently being exploited in the wild.

What is the severity rating of CVE-2026-54454?

The National Vulnerability Database rates the severity as CVSS 9.1 Critical.

Which specific file contains the vulnerable code?

The vulnerability is located in the modules/import/ImportUI.php file.