PatchTheCVECVE-2026-27760: OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint th
CVE-2026-27760 is a high-severity flaw (CVSS 8.1) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load wh
Why this priority
- High severity
- EPSS top 2%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 33.0% (top 2%) |
| CISA exploited list | No |
| Weakness | CWE-94 |
| Published | 2026-04-28 |
| Last modified | 2026-07-14 |
Last updated 2026-07-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Write-up: chocapikk.com/posts/2026/opencats-installer-rce/
- Write-up: www.vulncheck.com/advisories/opencats-php-code-injection-via-installer-ajax-endpoint
- Metasploit: OpenCATS Installer PHP Code Injection
- Nuclei scan template: OpenCATS - Command Injection
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-27760?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-27760 being exploited?
CVE-2026-27760 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-27760 affect?
CVE-2026-27760 affects affected software. Severity is high (CVSS 8.1). OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action par
How urgent is CVE-2026-27760?
Priority 63/100. High severity; EPSS top 2%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action