CVE-2021-41560

OpenCATS lets a remote attacker upload an executable file through lib/FileUtility.php and then run it, yielding arbitrary code execution on the server. This is the archetypal unauthenticated file-upload-to-RCE: no login to defeat, no user to trick, just a POST that plants executable content the app will happily serve back and run. For a web application that holds recruiting and candidate data, that's full server compromise from the outside.

This is exactly the profile mass-scanning botnets live for. Unauthenticated code execution in an installable open-source web app means proof-of-concept traffic tends to sweep every reachable install indiscriminately, hunting for the vulnerable endpoint regardless of who owns the site. Once a web shell lands, the outcomes are the usual: data theft from the applicant database, cryptomining, spam, or use as a beachhead into the hosting environment. The version ceiling — through 0.9.6 — is the only thing standing between an exposed install and a shell.

Self-hosted apps like OpenCATS are easy to lose track of, so our real work is finding the shadow installs. The question isn't reading this advisory, it's answering which OpenCATS instances we actually run, at what version, and which are internet-reachable — self-hosted recruiting tools often get stood up by a single team and never inventoried centrally. That intersection is the short, urgent patch list; anything exposed and at or below 0.9.6 is treated as pre-compromised until verified.