A flaw in OpenCATS’ Import module allows an authenticated user to upload a PHP file that the system preserves under its original name and stores in a web‑accessible temporary directory. If PHP execution is enabled for that directory, the attacker can trigger an import error that leaves the uploaded file on disk and subsequently request it, causing the server to execute arbitrary PHP code under the web server process. The vulnerability is a classic example of an insecure file upload leading to code execution, corresponding to CWE-434. The attack requires valid Import privileges but does not need special privileges beyond standard authenticated access.

OpenCATS versions prior to 0.10.0, specifically the Import module in modules/import/ImportUI.php, are affected. The vulnerability exists for all installations of the open‑source application that have not been upgraded.

The risk is high, with a CVSS score of 9.1. Exploit probability is unknown due to the lack of an EPSS score; however, the issue is not yet listed in CISA KEV, indicating it may not yet have widespread exploitation. Still, the combination of high severity and easy exploitation path makes it a critical threat.