CVE-2021-47936: OpenCATS 0.9.4 RCE Vulnerability

CVE-2021-47936 Overview

CVE-2021-47936 is a remote code execution vulnerability in OpenCATS 0.9.4, an open-source applicant tracking system. The flaw allows unauthenticated attackers to upload PHP files disguised as resume attachments through the public careers job application endpoint. After upload, attackers reach the file directly in the upload directory and execute arbitrary operating system commands through HTTP POST requests. The vulnerability stems from missing authentication on the upload workflow combined with insufficient validation of attachment file types, classified as [CWE-306] Missing Authentication for Critical Function.

Critical Impact

Unauthenticated remote attackers can achieve full code execution on the web server hosting OpenCATS 0.9.4 by uploading a PHP webshell through the public careers application form.

Affected Products

• OpenCATS 0.9.4
• OpenCATS deployments exposing the careers job application endpoint to the internet
• PHP-based installations where uploaded files in the attachment directory are directly executable

Discovery Timeline

• 2026-05-10 - CVE-2021-47936 published to the National Vulnerability Database
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2021-47936

Vulnerability Analysis

OpenCATS 0.9.4 exposes a public careers portal that accepts resume attachments from prospective applicants. The application processes uploads through the careers job application endpoint without requiring authentication. The upload handler fails to validate or sanitize the file extension of submitted attachments. Attackers can submit a .php file in place of an expected document type such as .pdf or .doc.

The uploaded payload is written to the attachment upload directory under the web root. The PHP interpreter then processes the file when it is requested over HTTP. Sending a POST request to the uploaded path executes the embedded PHP code in the context of the web server user. The combination of missing authentication and unrestricted file upload converts a public-facing form into a full remote code execution primitive.

Root Cause

The root cause is missing authentication on a privileged function, mapped to [CWE-306]. The careers application endpoint trusts unauthenticated input and writes attacker-controlled files to a directory served by the PHP runtime. There is no allowlist of extensions, no MIME-type enforcement, and no rename of uploaded content to a non-executable filename.

Attack Vector

The attack is network-reachable and requires no privileges or user interaction. An attacker browses the public careers page, submits a job application, and attaches a PHP webshell as the resume. The attacker then issues an HTTP POST request to the predictable upload path. Commands placed in request parameters are executed by the webshell, returning output in the HTTP response.

No verified proof-of-concept code is reproduced here. Refer to the Exploit-DB #50585 entry and the VulnCheck OpenCATS Advisory for technical details.

Detection Methods for CVE-2021-47936

Indicators of Compromise

• Files with .php, .phtml, or .phar extensions located in the OpenCATS attachments or upload directory
• HTTP POST requests from external sources to files inside the attachment upload path
• Unexpected child processes such as sh, bash, cmd.exe, or powershell.exe spawned by the PHP or web server process
• Outbound network connections originating from the OpenCATS web server to unfamiliar hosts shortly after a job application submission

Detection Strategies

• Monitor the OpenCATS upload directory for newly created files whose extensions are interpreted by PHP
• Alert on HTTP requests that target files inside the attachments directory and return non-empty response bodies
• Correlate careers form submissions with subsequent direct requests to the resulting attachment URL within a short time window
• Inspect web server access logs for POST requests to attachment paths, which is atypical for static resume files

Monitoring Recommendations

• Enable verbose logging on the web server and forward logs to a centralized analytics platform for retention and search
• Apply file integrity monitoring to the OpenCATS web root and attachment storage directories
• Track process lineage on the web server host so that shell and scripting interpreters launched by the PHP process generate alerts
• Review egress traffic from the OpenCATS host for command-and-control patterns following any upload activity

How to Mitigate CVE-2021-47936

Immediate Actions Required

• Restrict public access to the OpenCATS careers endpoint until the upload directory is hardened, using network controls or a web application firewall
• Audit the attachment upload directory for any existing PHP, phtml, or phar files and remove unauthorized artifacts
• Reconfigure the web server to disable PHP execution inside the OpenCATS attachment directory
• Rotate any credentials, API tokens, or database secrets accessible from the OpenCATS host if compromise is suspected

Patch Information

No fixed version is identified in the available advisory data for OpenCATS 0.9.4. Operators should monitor the GitHub OpenCATS Repository and the OpenCATS Official Website for security releases, and consult the VulnCheck OpenCATS Advisory for current remediation guidance.

Workarounds

• Configure the web server to refuse execution of files in the attachment directory, for example by setting php_admin_flag engine off or removing PHP handlers from that location
• Enforce an allowlist of resume file extensions such as .pdf, .doc, and .docx at the application or reverse-proxy layer
• Rename uploaded files to randomized, non-executable filenames and store attachments outside the web-accessible document root
• Place the careers portal behind a web application firewall rule that blocks uploads with executable content types

# Apache configuration example: disable PHP execution in the OpenCATS attachments directory
<Directory "/var/www/opencats/attachments">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
    Options -ExecCGI
</Directory>