CVE 9.2 CRITICAL

OpenCATS PHP Code Injection via installer AJAX endpoint_CVE-2026-27760

April 28, 2026 invoker category_cve

9.2 / 10

CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.

AI Analysis

PHP code injection vulnerability in the installer AJAX endpoint

Basic Information

ID CVE-2026-27760

Source VulnCheck

Published Apr 28, 2026 at 13:43

Modified Apr 28, 2026 at 13:55

Affected Product

Vendor opencats

Product OpenCATS

Affected Versions opencats OpenCATS 0

CWE Classification

CWE-94

AI Assessment

AI Score 9.2 / 10

AI Severity Critical

Vendor OpenCATS

Product OpenCATS

References

{
    "lastseen": "",
    "description": "OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.",
    "published": "2026-04-28T13:43:24.366Z",
    "modified": "2026-04-28T13:55:28.406Z",
    "type": "cve",
    "title": "OpenCATS PHP Code Injection via installer AJAX endpoint",
    "source": "VulnCheck",
    "references": "https://chocapikk.com/posts/2026/opencats-installer-rce/\nhttps://github.com/opencats/OpenCATS/pull/706\nhttps://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6\nhttps://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172\nhttps://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130\nhttps://www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint",
    "id": "CVE-2026-27760",
    "bulletinFamily": "",
    "cwe": [
        "CWE-94"
    ],
    "cvelist": null,
    "sourceData": "opencats OpenCATS 0",
    "sourceHref": "",
    "cvss": {
        "score": 9.2,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "OpenCATS",
    "version": "0",
    "vendor": "opencats",
    "ai_description": "PHP code injection vulnerability in the installer AJAX endpoint",
    "ai_severity": "Critical",
    "ai_vendor": "OpenCATS",
    "ai_product": "OpenCATS",
    "ai_version": "0",
    "ai_score": 9.2
}

💭 Join the Security Discussion ❌ Cancel Reply