CVE-2026-27760

OpenCATS, an open-source applicant tracking system, is affected by an unauthenticated PHP code injection flaw (CWE-94) in its installer AJAX endpoint in all versions prior to commit 3002a29. An attacker sends a crafted databaseConnectivity action to the installer, using a single quote and statement separator to break out of the define() string context in config.php and inject arbitrary PHP statements. The injected code persists in config.php and executes on every subsequent page load, giving the attacker unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Only deployments where the installation wizard has been left incomplete are exploitable, since the payload persists and runs only while installation remains unfinished. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the flaw carries a critical CVSS 4.0 score of 9.2 and an EPSS of 34.6% (98th percentile), signaling a high probability of exploitation attempts within 30 days.

What to do: Update OpenCATS to a build containing commit 3002a29 or later; note the fix is a source commit, so verify your checked-out code includes it. Operators who cannot patch immediately should complete the installation wizard or block unauthenticated access to the installer AJAX endpoint, then inspect config.php for unexpected injected PHP statements. Given the elevated EPSS, review config.php and recent activity for signs of compromise even on systems believed to be fully installed.