Executive brief
OpenCATS, an open-source applicant tracking system used by recruitment teams, contains a critical security flaw in its job application portal. An unauthorized person can upload a malicious file disguised as a resume to take complete control of the server. This could lead to the theft of sensitive candidate data, total service disruption, or the use of the server for further attacks.
Technical details
A remote code execution (RCE) vulnerability exists in OpenCATS versions 0.9.4 and earlier due to insufficient validation of uploaded files and missing authentication on critical functions (CWE-306). An unauthenticated attacker can exploit the 'careers' job application endpoint to upload a PHP payload disguised as a resume. Once uploaded, the file is stored in a predictable web-accessible directory (e.g., /upload/careerportaladd/), allowing the attacker to execute arbitrary system commands by sending POST requests to the uploaded file. A public exploit script is available, and users are advised to upgrade to version 0.10.0 or later.
Affected products
- Opencats OpenCATS <= 0.9.4
Timeline
- 2021-09-21: other: Vulnerability discovered/Exploit authored
- 2021-12-10: disclosed: Exploit published on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published