OpenCATS CVE-2026-54453

Requires a valid OpenCATS administrator-level account WITH Settings module access AND the specific permission to update the Professional License configuration (manageProfessional in SettingsUI), and config.php must be writable by the web server user - this write-based path fails if config.php is made read-only post-install. Exploitation is limited by the high privilege requirement (admin + Settings access); unauthenticated exploitation and exploitation by users without Settings access are explicitly not established by the vendor. No user interaction is needed beyond the attacker's own authenticated request. The only complete fix is upgrading to v0.10.0; restricting Settings access to trusted admins and making config.php read-only are partial mitigations the vendor states do not substitute for upgrading.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) describes a network-reachable, low-complexity flaw with full confidentiality, integrity and availability impact, but the PR:H metric is the decisive gate: exploitation requires an authenticated administrator with Settings-module access and permission to update the Professional License configuration, and config.php must be writable by the web server. This is therefore not a mass-exploitable perimeter bug but a privilege-dependent authenticated RCE. No EPSS probability and no CISA KEV entry are present in the supplied data, and no confirmed working exploit is listed - the references are the vendor advisory, fix PR, patch commit and release tag, i.e. remediation artifacts rather than exploit code. The vuln.today decision label is 'this_week', consistent with a serious but admin-gated issue rather than an emergency; the realistic risk is high against installations where multiple or lower-trust users hold admin/Settings rights, or where admin credentials can be phished or reused, and lower where admin access is tightly held. No signals conflict; the main limiter (high privilege) is confirmed by both the CVSS vector and the advisory text.

An authenticated OpenCATS user with administrator-level Settings access (or an attacker who has obtained such credentials) submits a crafted Professional License key through the manageProfessional feature; the value is reconstructed into a PHP define() statement in config.php without safe escaping, breaking the file's syntax so attacker-controlled PHP is written in. Because the application includes config.php on every request, the injected code executes persistently with the web server process privileges. No public working exploit is identified at time of analysis; network vector and low attack complexity make the write trivial once the admin precondition is met.