CVE-2026-27760
OpenCATS PHP Code Injection via installer AJAX endpoint
- State
- Published
- Severity
- 9.2 Critical
- Published
- Apr 28, 2026
- Updated
- Jul 14, 2026
- Reserved
- Feb 23, 2026
Description
OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
OpenCATSopencats |
|
References
- https://chocapikk.com/posts/2026/opencats-installer-rce/technical-descriptionexploit
- https://github.com/opencats/OpenCATS/pull/706issue-tracking
- https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6patch
- https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172related
- https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130related
- https://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.