CVE-2026-54453

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled license key input that is reconstructed into a PHP `define()` statement in `config.php` without safe escaping. Because the application includes `config.php`, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges. An authenticated administrator must have Settings module access and permission to update Professional License configuration, and `config.php` must be writable for this write-based path. Successful exploitation can read, modify or delete application data, expose candidate, contact, company, job order and user account information, alter the installation or configuration, and provide a foothold for further attacks. Unauthenticated exploitation and exploitation without Settings access are not established. This issue is fixed in version 0.10.0.

• CWE-74
• CWE-94

• https://github.com/opencats/OpenCATS/commit/e422abf3b75d467bdee65277f56e41dfba928fc8
• https://github.com/opencats/OpenCATS/pull/802
• https://github.com/opencats/OpenCATS/security/advisories/GHSA-627w-743r-4cg2
• https://github.com/opencats/OpenCATS/tree/v0.10.0

Published

Oct 28, 2026

Last Modified

Nov 3, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54448Trivy is a security scanner. Prior to 0.71.0, when Trivy sca…6.5
• CVE-2026-54449LangBot is a global IM bot platform designed for LLMs. In ve…8.8
• CVE-2026-5445An out-of-bounds read vulnerability exists in the `DecodeLoo…9.1
• CVE-2026-54450ToolHive is a utility designed to simplify the deployment an…2.9
• CVE-2026-54451Elixir protobuf is a pure Elixir implementation of Google Pr…8.2
• CVE-2026-54452safeurl is a server-side request forgery protection library.…6.3
• CVE-2026-54454OpenCATS is an open-source applicant tracking system and rec…9.1
• CVE-2026-54455OpenCATS is an open-source applicant tracking system and rec…7.6
• CVE-2026-54457TensorZero is an open-source LLMOps platform that unifies an…7.7
• CVE-2026-54458WWBN AVideo is an open source video platform. Versions prior…9.6
• CVE-2026-54459FileRise is a self-hosted web-based file manager with multi-…4.3
• CVE-2026-5446In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS …7.1