Quick answers
- Is CVE-2026-54454 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54454 being exploited in the wild.
- How severe is CVE-2026-54454?
- Critical severity, with a CVSS score of 9.1, published 13 October 2026.
- Which products and versions are affected?
- OpenCATS prior to 0.10.0.
- Is there a fix for CVE-2026-54454?
- Yes: fixed in 0.10.0. Until then: Disable PHP execution in the temporary directory by configuring the web server to prevent script execution in the directory specified by CATS_TEMP_DIR. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54454 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-54454?
- Check whether you run OpenCATS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.10.0
Disable PHP execution in the temporary directory by configuring the web server to prevent script execution in the directory specified by CATS_TEMP_DIR.
Technical details
The ImportUI.php module in OpenCATS prior to 0.10.0 preserves an uploaded file's original name and stores it in a web-accessible temporary directory without proper validation. An authenticated attacker with Import privileges can upload a PHP file with an attacker-controlled filename; if the temp directory has PHP execution enabled and an import error leaves the file on disk, the attacker can request the file to execute arbitrary PHP code with web server privileges.
Affected products
- OpenCATS OpenCATS prior to 0.10.0
Timeline
- 2026-10-13: disclosed
- 2026-06-23: patched