Critical severity · published May 10, 2026
CVE-2021-47936
OpenCATS 0.9.4 Remote Code Execution via Resume Upload
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Attackers can upload PHP payloads through the careers job application endpoint and execute system commands via POST requests to the uploaded file in the upload directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenCATS · Opencats
through 0.9.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47936
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47936
github.com
https://github.com/opencats/OpenCATS
www.exploit-db.com
https://www.exploit-db.com/exploits/50585
www.opencats.org
https://www.opencats.org/
www.vulncheck.com
https://www.vulncheck.com/advisories/opencats-remote-code-execution-via-resume-upload
More from OpenCATS
9.8
CVE-2022-48011
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function
9.8
CVE-2022-43019
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality
9.8
CVE-2021-41560
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php
9.8
CVE-2021-25294
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution
9.1
CVE-2026-54454
OpenCATS: Authenticated RCE in the Import module