Is CVE-2026-27760 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27760 being exploited in the wild.

How severe is CVE-2026-27760?

High severity, with a CVSS score of 8.1, published 28 April 2026.

Which products and versions are affected?

OpenCATS prior to commit 3002a29.

Is there a fix for CVE-2026-27760?

A patch was published on 2026-04-21: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27760 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-27760?

Check whether you run OpenCATS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27760: OpenCATS PHP code injection in installer AJAX endpoint

CVE-2026-27760 · Severity: high · CVSS 8.1 · Published 2026-04-28

OpenCATS, an open-source applicant tracking system, contains a vulnerability in its installation process. If the installation wizard has not been completed, an unauthenticated attacker can inject malicious code into the system's configuration file. This allows the attacker to take full control of the server, potentially leading to the theft of sensitive recruitment data or a complete service outage.

Technologies: OpenCATS. Vendors: OpenCATS.

Quick answers

Is CVE-2026-27760 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27760 being exploited in the wild.
How severe is CVE-2026-27760?: High severity, with a CVSS score of 8.1, published 28 April 2026.
Which products and versions are affected?: OpenCATS prior to commit 3002a29.
Is there a fix for CVE-2026-27760?: A patch was published on 2026-04-21: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27760 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-27760?: Check whether you run OpenCATS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A PHP code injection vulnerability exists in the OpenCATS installer AJAX endpoint (modules/install/ajax/ui.php). The application fails to sanitize the 'user' parameter (and others like 'pass', 'host', and 'name') within the databaseConnectivity action before passing it to CATSUtility::changeConfigSetting(). This function interpolates the raw input into a define() statement in config.php. An attacker can break out of the string context using a single quote and statement separator to inject arbitrary PHP code. This code persists in config.php and executes on every subsequent page load. The attack is possible only if the INSTALL_BLOCK file is absent, indicating an incomplete installation. The issue was fixed in commit 3002a29 by escaping values using var_export() before writing to the configuration file.

Affected products

OpenCATS OpenCATS prior to commit 3002a29

Timeline

2026-02-27: disclosed: Vulnerability discovered and maintainer notified
2026-04-21: patched: Fix merged into master branch
2026-04-28: advisory: Public disclosure and CVE assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.