The vulnerability in OpenCATS 0.9.4 permits an unauthenticated attacker to upload a PHP file disguised as a resume via the careers job application endpoint. When the uploaded file is later accessed through a POST request, arbitrary shell commands are executed on the server, providing full control of the system. The weakness is a missing authentication check (CWE‑306) that allows upload of executable PHP payloads.

OpenCATS version 0.9.4 is the only version explicitly listed as vulnerable in the CNA data. No other versions or related products are specified, so the impact is limited to deployments that are running that exact version or an unpatched default installation.

The CVSS base score of 9.3 signals critical severity. EPSS is not available, so the relative exploitation likelihood cannot be quantified. The exploit-db reference demonstrates a publicly available exploitation method; based on the references, it is inferred that the flaw can be readily exploited by attackers. The vulnerability is not listed in the CISA KEV catalog, but the presence of an active public exploit indicates an elevated risk for systems hosting the affected application.