Executive brief
OpenCATS, an open-source applicant tracking system, contains a vulnerability in its installation process. If the installation wizard has not been completed, an unauthenticated attacker can inject malicious code into the system's configuration file. This allows the attacker to take full control of the server, potentially leading to the theft of sensitive recruitment data or a complete service outage.
Technical details
A PHP code injection vulnerability exists in the OpenCATS installer AJAX endpoint (modules/install/ajax/ui.php). The application fails to sanitize the 'user' parameter (and others like 'pass', 'host', and 'name') within the databaseConnectivity action before passing it to CATSUtility::changeConfigSetting(). This function interpolates the raw input into a define() statement in config.php. An attacker can break out of the string context using a single quote and statement separator to inject arbitrary PHP code. This code persists in config.php and executes on every subsequent page load. The attack is possible only if the INSTALL_BLOCK file is absent, indicating an incomplete installation. The issue was fixed in commit 3002a29 by escaping values using var_export() before writing to the configuration file.
Affected products
- OpenCATS OpenCATS prior to commit 3002a29
Timeline
- 2026-02-27: disclosed: Vulnerability discovered and maintainer notified
- 2026-04-21: patched: Fix merged into master branch
- 2026-04-28: advisory: Public disclosure and CVE assigned
References
- https://chocapikk.com/posts/2026/opencats-installer-rce/
- https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php
- https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php
- https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6
- https://github.com/opencats/OpenCATS/pull/706
- https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint