Understanding and Defending Against Stored Cross-Site Scripting (XSS) in OpenCATS

Overview

CVE-2026-115513 is a stored cross-site scripting (XSS) vulnerability in OpenCATS, a popular open-source candidate applicant tracking system. This vulnerability affects versions before 0.12.0 and has a CVSS score of 8.7, indicating a high severity level. The vulnerability allows a low-privileged authenticated user to inject HTML/JavaScript payloads into various fields, which are then stored unsanitized and rendered unescaped in the 'Recent' (MRU) navigation panel. This can lead to arbitrary JavaScript execution in the session of any user, including Site Administrators, who views the record.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability is the lack of proper input sanitization and output encoding in OpenCATS. Specifically, the `lib/MRU.php` file's `getFormatted()` function renders user-input data unescaped, allowing an attacker to inject malicious JavaScript code. This is a classic example of a stored XSS vulnerability, which falls under the CWE-79 category.

Attack Surface & Vector

The attack surface for this vulnerability is relatively large, as it affects multiple fields in OpenCATS, including Candidate, Company, Contact, Job Order, and List name/title fields. An attacker needs to be a low-privileged authenticated user to exploit this vulnerability. The attack vector is network-adjacent, and user interaction is required (i.e., another user must view the malicious record).

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Corporate OpenCATS Instance 1. Initial Position: An attacker gains access to a corporate OpenCATS instance as a low-privileged user. 2. Triggering the Flaw: The attacker crafts a malicious record name that includes an HTML/JavaScript payload and injects it into a Candidate, Company, Contact, Job Order, or List name/title field. 3. What Breaks: When another user, including a Site Administrator, views the record, the malicious JavaScript code is executed in their session. This allows the attacker to bypass security restrictions and gain elevated privileges. 4. Attacker's Prize: The attacker can now steal session/cookie information, escalate privileges to full administrative control, and potentially move laterally within the corporate network.

Real-World Impact

The potential impact of this vulnerability is significant, as it can lead to unauthorized access, data theft, and lateral movement within a corporate network. If actively exploited in the wild, this vulnerability could compromise sensitive information and disrupt business operations.

Detection & Defense

Immediate Mitigations

To address this vulnerability, users should upgrade OpenCATS to version 0.12.0 or later. Additionally, administrators can review user-input data and ensure that it is properly sanitized and encoded.

Detection Strategies

Defenders can detect exploitation attempts by monitoring for suspicious user activity, such as unusual login attempts or modifications to sensitive fields. They can also implement SIEM rules to alert on potential XSS attacks.

Long-Term Hardening

To prevent similar vulnerabilities in the future, developers should implement robust input validation and output encoding mechanisms. They should also conduct regular security audits and penetration testing to identify potential weaknesses.

Key Takeaways

* Stored XSS vulnerabilities can have a significant impact on an organization's security posture. * Proper input sanitization and output encoding are crucial in preventing XSS attacks. * Regular security audits and penetration testing can help identify potential weaknesses. * Upgrading to the latest version of OpenCATS (0.12.0 or later) can mitigate this vulnerability.

Sources

* National Vulnerability Database (NVD) - CVE-2026-115513 * OpenCATS GitHub repository * Vulncheck advisory