CVE-2026-54453— OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

Quick assessment

Affected

opencats OpenCATS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenCATS 是一款面向招聘机构和招聘团队的开源求职者追踪系统与招聘客户关系管理（CRM）工具。在 0.10.0 版本之前，中的专业许可证配置功能（）会接受由管理员控制的许可证密钥输入，并将其未经安全转义地重建为中的 PHP 语句。由于应用程序会包含（include），攻击者可构造恶意输入以篡改该文件的 PHP 语法，从而以 Web 服务器进程的权限实现持久化的任意 PHP 代码执行。成功利用此漏洞需要满足以下条件：攻击者必须是已认证的管理员，拥有“设置”模块的访问权限及更新专业许可证配置的权限，且

CVSS 7.2 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1574 · Hijack Execution Flow T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

Source: CVE Program / CVE List V5

Vulnerability Description

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled license key input that is reconstructed into a PHP `define()` statement in `config.php` without safe escaping. Because the application includes `config.php`, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges. An authenticated administrator must have Settings module access and permission to update Professional License configuration, and `config.php` must be writable for this write-based path. Successful exploitation can read, modify or delete application data, expose candidate, contact, company, job order and user account information, alter the installation or configuration, and provide a foothold for further attacks. Unauthenticated exploitation and exploitation without Settings access are not established. This issue is fixed in version 0.10.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

输出中的特殊元素转义处理不恰当(注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
opencats	OpenCATS	< 0.10.0	-

II. Public POCs for CVE-2026-54453

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54453

请登录查看更多情报信息。

Other References for CVE-2026-54453 (4)

https://github.com/opencats/OpenCATS/pull/802 x_refsource_MISC
https://github.com/opencats/OpenCATS/tree/v0.10.0 x_refsource_MISC
https://github.com/opencats/OpenCATS/security/advisories/GHSA-627w-743r-4cg2 x_refsource_CONFIRM
https://github.com/opencats/OpenCATS/commit/e422abf3b75d467bdee65277f56e41dfba928fc8 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54453

IV. Related Vulnerabilities

Same product: OpenCATS

Same vendor: opencats

Same weakness: CWE-74