PT-2026-35727 · Opencats · Opencats

Valentin Lobstein + 1 · Published 2026-04-28 · Updated 2026-06-17 · CVE-2026-27760

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenCATS versions prior to commit 3002a29

Description An unauthenticated PHP code injection issue exists in the installer AJAX endpoint. This allows attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. By using a single quote and statement separator, an attacker can break out of the define() string context in the config.php file. The injected malicious code persists and executes on every subsequent page load as long as the installation wizard remains incomplete.

Recommendations Update to commit 3002a29 or a newer version.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-27760

Affected Products

Opencats

References · 12

• 🔥 https://chocapikk.com/posts/2026/opencats-installer-rce · Exploit
• https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27760 · Security Note
• https://github.com/opencats/OpenCATS/pull/706 · Note
• https://github.com/opencats/OpenCATS/blob/46e4727/modules/install/ajax/ui.php#L130 · Note
• https://github.com/opencats/OpenCATS/blob/46e4727/lib/CATSUtility.php#L142-L172 · Note
• https://twitter.com/VulmonFeeds/status/2049231819862630670 · Twitter Post
• https://t.me/CVEtracker/52085 · Telegram Post
• https://twitter.com/Chocapikk_/status/2049124793107030102 · Twitter Post
• https://vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint · Note
• https://twitter.com/pdnuclei_bot/status/2067215718253523045 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2049164253957939330 · Twitter Post