{"id":"CVE-2026-54453","kind":"vulnerability","aliases":["CVE-2026-54453"],"related":[],"title":"OpenCATS: license key input writes PHP code into config.php","description":"OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled license key input that is reconstructed into a PHP `define()` statement in `config.php` without safe escaping. Because the application includes `config.php`, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges. An authenticated administrator must have Settings module access and permission to update Professional License configuration, and `config.php` must be writable for this write-based path. Successful exploitation can read, modify or delete application data, expose candidate, contact, company, job order and user account information, alter the installation or configuration, and provide a foothold for further attacks. Unauthenticated exploitation and exploitation without Settings access are not established. This issue is fixed in version 0.10.0.","summary":"OpenCATS before 0.10.0 writes the Professional License key into config.php inside a PHP define() statement without escaping. An authenticated administrator with Settings access can break out of that statement and make the web server run arbitrary PHP that persists in the config file.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["opencats","package","php","recruiting","self-hosted"],"not_affected_if":["config-not-writable","no-settings-access","upgraded-to-0.10.0"],"how_to_check":"- Check the installed OpenCATS version against `0.10.0` in the application's version file or admin footer.\n- Confirm whether `config.php` is writable by the web server user, for example with `ls -l config.php`, since the write path requires it.","fix":"- Upgrade OpenCATS to `0.10.0` or later.\n- Until upgraded, make `config.php` read-only for the web server user and restrict Settings and Professional License access to trusted administrators.","status":"open","published_at":"2026-10-28T22:17:15+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","triaged_at":"2026-10-28T22:36:50+00:00","updated_at":"2026-10-28T22:36:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T22:36:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenCATS to `0.10.0` or later.\n- Until upgraded, make `config.php` read-only for the web server user and restrict Settings and Professional License access to trusted administrators.","reach":"network","title":"OpenCATS: license key input writes PHP code into config.php","impact":"high","summary":"OpenCATS before 0.10.0 writes the Professional License key into config.php inside a PHP define() statement without escaping. An authenticated administrator with Settings access can break out of that statement and make the web server run arbitrary PHP that persists in the config file.","category":"package","nicknames":[],"who_cares":["opencats","self-hosted","php","recruiting"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs PHP on the server and reads or deletes candidate and user data.","analyst_note":"","how_to_check":"- Check the installed OpenCATS version against `0.10.0` in the application's version file or admin footer.\n- Confirm whether `config.php` is writable by the web server user, for example with `ls -l config.php`, since the write path requires it.","needs_analyst":false,"not_affected_if":["upgraded-to-0.10.0","config-not-writable","no-settings-access"],"who_is_affected":"Self-hosted OpenCATS installations running a version before 0.10.0 are exposed, especially where many staff hold administrator or Settings permissions and config.php is writable by the web server. Hosted or already-upgraded installations can skip it. Unauthenticated users cannot trigger it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3541,"output_tokens":567,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-54453':12A,15A '0.10.0':25B,87C,215C 'accept':96C 'access':45B,149C,205C 'account':185C 'administr':42B,98C,144C 'administrator-control':97C 'agenc':80C 'alter':124C,187C 'applic':72C,118C,175C 'arbitrari':58B,133C 'attack':198C 'authent':41B,143C 'base':166C 'break':47B 'candid':178C 'caus':131C 'code':7A 'compani':180C 'config':64B 'config.php':9A,32B,112C,120C,158C 'configur':91C,156C,191C 'contact':179C 'control':99C 'craft':121C 'crm':77C 'cve':10A,13A 'data':176C 'defin':36B,109C 'delet':174C 'escap':39B,115C 'establish':208C 'execut':135C 'exploit':169C,200C,202C 'expos':177C 'featur':92C 'file':65B,126C 'fix':212C 'foothold':195C 'hire':82C 'host':22B 'includ':119C 'inform':186C 'input':4A,102C,122C 'insid':33B 'instal':189C 'issu':210C 'job':181C 'key':3A,30B,101C 'licens':2A,29B,90C,100C,155C 'make':53B 'manageprofession':95C 'modifi':172C 'modul':148C 'must':145C,159C 'open':70C 'open-sourc':69C 'opencat':1A,16B,23B,66C 'order':182C 'packag':17B 'path':167C 'permiss':151C 'persist':61B,132C 'php':6A,18B,35B,59B,108C,128C,134C 'prior':84C 'privileg':141C 'process':140C 'profession':28B,89C,154C 'provid':193C 'read':171C 'reconstruct':105C 'recruit':19B,76C 'run':57B 'safe':114C 'self':21B 'self-host':20B 'server':56B,139C 'set':44B,147C,204C 'settingsui':94C 'sourc':71C 'staf':79C 'statement':37B,51B,110C 'success':168C 'syntax':129C 'system':74C 'team':83C 'track':73C 'unauthent':199C 'updat':153C 'user':184C 'version':86C,214C 'web':55B,138C 'without':38B,113C,203C 'writabl':161C 'write':5A,26B,165C 'write-bas':164C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted OpenCATS installations running a version before 0.10.0 are exposed, especially where many staff hold administrator or Settings permissions and config.php is writable by the web server. Hosted or already-upgraded installations can skip it. Unauthenticated users cannot trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54453","severity":null,"published_at":"2026-10-28T22:17:15+00:00","modified_at":"2026-10-28T22:17:15+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","fetched_at":"2026-10-28T22:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}