OpenCATS uses the Professional License configuration in SettingsUI to rebuild an administrator-provided license key into a PHP define statement that is written to config.php. Because the input is not escaped, an attacker can craft a license key that injects PHP code into the file. The injected code then runs with web‑server privileges, giving the attacker persistent capability to read, modify or delete application data, expose personal and business information, and pivot to further compromises. The flaw is a classic code injection identified by CWE‑74 and CWE‑94, leading to authenticated remote code execution.

OpenCATS version 0.10.0 and earlier are affected. The vulnerable logic is part of the SettingsUI module that handles Professional License configuration. Any administrator who has Settings module access and permission to update the license, and whose OpenCATS installation’s config.php is writable, can exploit the flaw. Only OpenCATS software is listed as the vendor and product. The issue is resolved in version 0.10.0.

With a CVSS score of 7.2 the vulnerability carries medium severity. The EPSS score is not available, but given the lack of evidence for public exploitation and its absence from the CISA KEV catalog, the immediate risk appears moderate. An attacker needs to authenticate as an administrator with Settings module permissions and require that config.php is writable. Once those conditions are met, the attacker can inject persistent PHP code that executes under the web server’s privileges, enabling full authorization bypass and complete compromise of the installation.