OpenCATS EUVD-2026-26052

Installation wizard must remain incomplete and accessible - specifically, the /modules/install/ajax/ui.php endpoint must be reachable and the config.php file must be writable by the web server process. This creates a time-limited attack window during initial deployment or interrupted setup scenarios. The vulnerability does NOT affect completed installations where the installer has been properly finalized or removed. Network accessibility to the installer endpoints is required (AV:N), but no authentication is needed (PR:N). High attack complexity (AC:H) stems from the requirement to identify the narrow window when installations are in-progress rather than technical difficulty - the actual exploit technique is straightforward once the vulnerable state is located. Successful exploitation requires the web server to have write permissions to the application configuration directory, which is standard during installation but may be restricted in hardened environments.

Real-world risk is MODERATE-HIGH despite the 8.1 CVSS score due to conflicting attack complexity signals. CVSS vector shows AV:N/AC:H/PR:N/UI:N - network-accessible, no authentication required, but HIGH complexity. The AC:H rating accurately reflects that exploitation requires the installation wizard to be incomplete and accessible, creating a time-limited attack window during initial deployment rather than persistent exposure in production systems. Publicly available exploit code (chocapikk.com writeup) significantly lowers exploitation barriers for attackers who can identify exposed installers. However, the attack surface is constrained: only NEW installations or interrupted setups are vulnerable, not existing production deployments. EPSS data not provided, but the combination of public POC plus unauthenticated network vector suggests moderate exploitation probability against internet-exposed instances during setup. No CISA KEV listing indicates this is not yet seeing widespread active exploitation. Priority depends on deployment practices - organizations that expose installers to the internet or have lengthy setup procedures face higher risk. Automated scanning for incomplete OpenCATS installations is feasible, making this automatable once deployment is detected.

An attacker discovers an internet-accessible OpenCATS instance with an incomplete installation by scanning for /modules/install/ paths. They craft a POST request to the installer's AJAX endpoint (/modules/install/ajax/ui.php) with a malicious databaseConnectivity action parameter containing a single quote to break out of the define() string context, followed by injected PHP code (e.g., web shell or reverse shell payload). The installer writes this malicious input directly into config.php without sanitization, persisting the code. On every subsequent page load, the injected PHP executes with web server privileges, granting the attacker persistent remote code execution to exfiltrate data, pivot to internal networks, or establish command-and-control infrastructure.