---
id: CVE-2026-54454
title: >-
  OpenCATS is an open-source applicant tracking system and recruitment CRM for
  staffing agencies and hiring teams
summary: >-
  OpenCATS is an open-source applicant tracking system and recruitment CRM for
  staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import
  module in modules/import/ImportUI.php can preserve an uploaded file's original
  name for…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-434
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T21:17:39.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54454'
references:
  - url: >-
      https://github.com/opencats/OpenCATS/commit/7f151741598c36c8233ada4b6b64f12b721d4907
    label: security-advisories@github.com
  - url: 'https://github.com/opencats/OpenCATS/pull/808'
    label: security-advisories@github.com
  - url: 'https://github.com/opencats/OpenCATS/releases/tag/v0.10.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/opencats/OpenCATS/security/advisories/GHSA-v9gx-5qhj-jf7c
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-13T17:38:53.195Z'
---

## Overview

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.