CVE-2019-13358: Opencats

High severity, CVSS 7.5. EPSS: 24.3% chance of exploitation in the next 30 days.

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.

Affected products

• Opencats Opencats: before 0.9.4-3 (fixed in 0.9.4-3)

Published 2019-07-05. Last modified 2026-06-17.