OpenCATS EUVD-2026-98922

Three conditions must all hold: (1) the attacker has an authenticated OpenCATS account with Import privileges (PR:H); (2) they use the specific single import data type whose code path preserved the uploaded file's original (attacker-controlled) filename rather than randomizing it - in the vulnerable modules/import/ImportUI.php the non-'Resume' path randomized names while one path kept the original, and an import error leaves the staged file on disk; and (3) critically, the CATS_TEMP_DIR temporary directory must be served by the web server WITH PHP execution enabled. Limiting factors: this executable-temp-dir setting is not a default hardened configuration, authentication plus Import privilege is required, and affected versions are strictly before 0.10.0. Where the temp directory does not execute PHP, the uploaded file cannot run and impact is substantially reduced.

Signals are mixed, pointing to a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (9.1 Critical, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) rates this Critical largely because of the scope change and triple-H impact of PHP RCE, but PR:H confirms the attacker must already be an authenticated user holding Import privileges - a meaningful barrier not reflected in the headline score. The AC:L assigned by the vendor understates a key gatekeeper: exploitation only works 'if the temporary directory is served with PHP execution enabled,' which is a non-default and often-absent deployment condition, so real-world exploitability is narrower than 9.1 suggests. No EPSS score, CISA KEV entry, or SSVC decision data was provided, and no public exploit was identified; the GitHub artifacts are the vendor patch (PR #808 / commit 7f15174) and advisory, not weaponized exploit code. Net: a genuine privileged-attacker RCE worth patching promptly, but the combination of required Import privileges plus a non-default executable-temp-dir configuration makes widespread opportunistic exploitation unlikely absent further intelligence.

An authenticated recruiter-level user with Import privileges selects the one affected import data type and uploads a PHP webshell whose original attacker-chosen filename is preserved and staged in the web-accessible temporary directory; a deliberately triggered import error leaves the file on disk. If that directory is configured to execute PHP, the attacker then requests the staged filename directly to run arbitrary code as the web server user. No public exploit code was identified, though the vendor patch diff reveals the vulnerable logic in detail.