Arbitrary PHP Execution in OpenCATS Applicant Tracking System

CVE-2026-54453

What is CVE-2026-54453?

OpenCATS, an open-source applicant tracking system and recruitment CRM, is susceptible to a vulnerability due to its Professional License configuration feature. This feature allows administrator-controlled license key inputs which are reconstructed into a PHP define statement within config.php, lacking proper escaping mechanisms. If the config.php file is writable, an authenticated administrator with access to the Settings module can inadvertently alter the PHP syntax through crafted input, leading to persistent execution of arbitrary PHP code with web server privileges. Exploitation of this vulnerability can result in unauthorized access to sensitive application data, including candidate and user account information, potentially altering the system's installation and configuration settings, and establishing a foothold for further attacks. This vulnerability has been addressed in version 0.10.0.

References