Security readout for executives and security teams
Plain-English summary
A flaw in OpenCATS 0.9.4 (a recruiting and applicant-tracking system) lets an unauthenticated attacker upload a booby-trapped file disguised as a resume and then run commands on the server. In plain terms, anyone on the internet who can use the careers page could potentially take over the recruiting system and the candidate data it holds.
Executive priority
Treat as urgent if OpenCATS 0.9.4 is internet-exposed. Unauthenticated remote code execution on an HR recruiting system risks candidate data exposure, lateral movement, and reputational harm. Prioritize isolation and vendor guidance review this week.
Technical view
CVE-2021-47936 is an unauthenticated remote code execution in OpenCATS 0.9.4 (CWE-306, CVSS 9.8 AV:N/AC:L/PR:N/UI:N). The careers job-application endpoint accepts resume uploads without enforcing authentication or robust file-type validation, allowing a PHP payload to be written to a web-reachable upload directory and executed via a subsequent HTTP POST, yielding command execution in the web server context.
Likely exposure
Affects OpenCATS 0.9.4 careers/job application endpoints that accept resume uploads. Highest exposure is internet-facing recruiting portals that allow public submissions without authentication. Internal-only deployments behind SSO or VPN have reduced but non-zero exposure.
Exploitation context
Public exploit code is available on ExploitDB (50585) and a VulnCheck advisory documents the technique. The CVE is not listed in CISA KEV, and no confirmed active exploitation is cited in the bundle. The low complexity and public PoC raise opportunistic-scanning risk for exposed instances.
Researcher notes
Root cause is missing authentication on a sensitive upload endpoint (CWE-306) combined with insufficient file-type validation, allowing PHP payloads in the resume upload flow to be reached and executed from the web-accessible upload directory. ExploitDB 50585 documents the chain. Validate via authenticated file-system inspection of the upload directory for unexpected .php/.phtml/.phar artifacts and web-server logs for POSTs to those files. Avoid running public PoCs against production.
Mitigation direction
- Inventory OpenCATS deployments and confirm whether the careers upload endpoint is reachable from the internet.
- Remove public access to upload paths or front the application with a WAF that blocks PHP file content and double-extensions.
- Restrict execution permissions on the upload directory so uploaded files cannot run as PHP.
- Check the OpenCATS GitHub repository and vendor site for an official patch or hardened release.
- If no fix is available, take the careers submission flow offline until vendor guidance is confirmed.
Validation and detection
- Confirm OpenCATS version; 0.9.4 is the named vulnerable build per the advisory.
- Review web-server access logs for POSTs to files inside the resume upload directory, especially with .php-family extensions.
- Audit the upload directory for files whose extension or MIME type does not match a legitimate resume.
- Run an authenticated configuration check to confirm the upload path does not allow script execution.
- Coordinate any active testing with the application owner; do not run public PoC code against production.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47936 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50585CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- Product ReferenceCVE reference, VulnCheck · product
- VulnCheck Advisory: OpenCATS 0.9.4 Remote Code Execution via Resume UploadCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.