Which versions of OpenCATS are affected by CVE-2026-27760?

OpenCATS installer versions prior to patch commit 3002a29 contain a remote code execution vulnerability (CVE-2026-27760, CVSS 8.1) that allows unauthenticated attackers to execute arbitrary PHP code…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27760?

Yes, a public proof-of-concept exploit is available for CVE-2026-27760. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27760?

Within 24 hours: identify all OpenCATS instances in your environment and verify installation status (prioritize any incomplete installations). Within 7 days: apply vendor patch (GitHub commit 3002a29 or later) to all OpenCATS installations and complete or remove any incomplete installation wizards. Within 30 days: conduct code review of affected config.php files and review access logs for the AJAX databaseConnectivity endpoint during the installation period to detect potential prior exploitation.

OpenCATS CVE-2026-27760

Q: What is the CVSS score of CVE-2026-27760?

CVE-2026-27760 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26052 CRITICAL

Code Injection (CWE-94)

2026-04-28 VulnCheck

PHP RCE Code Injection Opencats

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 28, 2026 - 20:18 vuln.today

Public exploit code

Re-analysis Queued

Apr 28, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

Apr 28, 2026 - 15:22 NVD

HIGH CRITICAL

CVSS changed

Apr 28, 2026 - 15:22 NVD

8.1 (HIGH) 9.2 (CRITICAL)

Analysis Generated

Apr 28, 2026 - 15:00 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 14:30 euvd

EUVD-2026-26052

Analysis Generated

Apr 28, 2026 - 14:30 vuln.today

Patch released

Apr 28, 2026 - 14:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 13:43 nvd

CRITICAL 9.2

DescriptionCVE.org

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.

AnalysisAI

Remote code execution in OpenCATS installer allows unauthenticated attackers to inject and execute arbitrary PHP code by manipulating the AJAX endpoint's databaseConnectivity action parameter. The injected code persists in config.php and executes on every page load while the installation wizard remains incomplete. Publicly available exploit code demonstrates breakout from define() string context using quote and statement separator techniques. Patch available via GitHub commit 3002a29, though CVSS AC:H (high complexity) suggests exploitation requires specific timing or environmental conditions during installation phase.

Technical ContextAI

OpenCATS is an open-source applicant tracking system built in PHP. This vulnerability (CWE-94: Improper Control of Generation of Code) exists in the installation wizard's AJAX endpoint (modules/install/ajax/ui.php), specifically in the databaseConnectivity action handler. The installer writes configuration values to config.php using PHP's define() function without proper input sanitization. Attackers exploit insufficient escaping in the CATSUtility.php configuration writer (lines 142-172) to inject PHP code. By sending crafted parameters containing single quotes and PHP statement separators (semicolons), attackers break out of the string context within define() calls and inject arbitrary PHP statements. The malicious code persists in the configuration file and executes server-side on every subsequent page request, achieving persistent remote code execution. The vulnerability only affects installations where the setup wizard has not been completed, creating a race condition window during deployment.

RemediationAI

Upgrade to OpenCATS commit 3002a29f4c3cada1aa2c4f3d4ae4e189906606b6 or later, available via GitHub pull request #706 (https://github.com/opencats/OpenCATS/pull/706). Organizations should verify no tagged release version number has been published yet - apply the commit patch directly from the repository. Immediate compensating controls for systems that cannot be patched: (1) Complete the installation wizard fully on all OpenCATS instances to close the vulnerable AJAX endpoint access, noting this permanently removes the attack surface. (2) Restrict network access to installation paths (/modules/install/*) using web server rules or firewall ACLs, allowing only trusted admin IPs during setup - trade-off is operational overhead for distributed teams. (3) Delete or rename the /modules/install/ directory after completing installation, though this may complicate future reinstallation scenarios. (4) Monitor config.php for unexpected modifications or PHP code outside define() statements as breach indicator. For new deployments, complete installation in isolated network segments before internet exposure.