File Upload Vulnerability in OpenCATS by OpenCATS

CVE-2026-54454

What is CVE-2026-54454?

The OpenCATS Import module allows authenticated users to upload files with original names preserved, potentially placing them in a web-accessible directory. If a PHP file is uploaded and an import error occurs, the file may remain on the server, leading to arbitrary PHP code execution. This vulnerability could expose or modify sensitive recruitment data and compromise the host system’s integrity. Users should upgrade to version 0.10.0 to mitigate this risk.

References