OpenCATS Newsletter

OpenCATS v0.11.1 released

2026-09-03T00:00:00+00:00

OpenCATS v0.11.1 is available

OpenCATS v0.11.1 is now available from the OpenCATS GitHub releases page.

This is primarily a security and maintenance release. It includes additional hardening in import handling, candidate merge processing, installer validation, advanced search output escaping, and extra-field validation.

The release also includes Career Portal fixes, improved installer and legacy database upgrade coverage, restored full release packages containing production dependencies, and expanded contributor documentation.

OpenCATS v0.11.1 is tested against PHP 8.4.1 and PHP 8.5. The release pipeline runs PHPUnit unit and integration tests together with the default and security Behat suites.

Users running older OpenCATS releases are encouraged to upgrade. As always, take a complete backup of the OpenCATS database and attachments before upgrading.

If you encounter an issue with the release, please report it in the OpenCATS GitHub issue tracker.

OpenCATS July 2026 project update

2026-07-09T00:00:00+00:00

July 2026 project update

It has been a busy few weeks for OpenCATS since the v0.10.0 release, with work continuing on usability, installation reliability, security hardening, and the foundations needed for future releases.

One of the most visible improvements is the addition of CAPTCHA validation for career portal applications. That should help reduce unwanted submissions while keeping the public application workflow available for teams that rely on the portal. Country support has also been added, giving OpenCATS a stronger base for international deployments and cleaner handling of location-related information.

There has also been a lot of work around installation and upgrades. The installer now does a better job of running existing-installation migrations before asking setup questions, and the site settings can prefill the phone country code during installation. Several schema and migration cleanups landed as well, including fixes for duplicate migration numbering, migration syntax, nullable definitions, and guarded migration keys. In short: less friction for fresh installs, and a more predictable path for maintained installations.

Security and data hygiene continued to receive attention. OpenCATS now denies direct Apache web access to the temporary directory, validates staged import file identifiers, and cleans up related records when entities are deleted. Those are the kind of behind-the-scenes changes that may not be flashy, but they help keep deployments safer and databases tidier over time.

The issue tracker was quieter for new reports during this period, with no new issues opened between the v0.10.0 release and this update. A few older issues were closed, including reports about phone field validation, missing field definition IDs for required address fields, and activity logging offering jobs that should not appear. Another longer-running discussion about activity stream sorting and pagination was updated and remains open, so it is still available for anyone interested in improving how activity history is reviewed.

Developers and contributors should also notice ongoing modernization. The project has continued moving toward stronger PHP 8 compatibility, replacing legacy database result handling, removing old licensing code, and improving test coverage and CI reporting. Behat screenshots and JUnit reports are now easier to review from CI, Dependabot automation has been improved, and dependency updates are continuing to flow through the project.

We plan to continue publishing these project summaries monthly so the community can follow what changed, what was fixed, and which issues still need attention without having to read every commit or pull request individually. As always, if you are testing OpenCATS or running it in production, please keep sharing feedback through the project’s GitHub issue tracker and discussions. The recent work is a good reminder that OpenCATS is improving not just through big releases, but through steady maintenance, review, and community contributions.

OpenCATS v0.10.0 released

2026-06-23T00:00:00+00:00

OpenCATS v0.10.0 is available

OpenCATS v0.10.0 is now available from the OpenCATS GitHub releases page.

Review the release notes and installation documentation before upgrading or installing a new instance:

If you encounter an issue with the release, please report it in the OpenCATS GitHub issue tracker.

0.9.7 Security update

2023-01-30T00:00:00+00:00

Security release and vulnerability news

After a detailed security audit, we have released OpenCATS version 0.9.7 which detected and corrected several vulnerabilities.

Overview

@hansmach1ne identified a number of vulnerabilities on the ‘internal’ webpages and would require a valid username/password to reach. It’s been greatly appreciated by the project that these vulnerabilities were checked and mitigating PRs proposed.

I’m very appreciative of the work that they’ve put in here and once the release is produced will share it on the project website.

Mitigation steps - I’d always recommend users / admins read the security guidelines and think carefully for themselves https://github.com/opencats/OpenCATS/wiki/Security-Considerations which actually include mention of some of these ‘internal facing’ vulnerabilities

Remediation

We recommend that you upgrade your OpenCATS instance asap.

If you wish to apply a fix instead, please view the changes in the GitHub PR instead.

Thanks

We are extremely grateful to @hansmach1ne for finding these vulnerabilities and proposing remediation steps.

Support queries?

If you have questions regarding this security fix, review the OpenCATS GitHub Security Advisories or join the conversation in GitHub Discussions. If you have found a code issue, raise an issue on GitHub

0.9.4 Security update

2019-07-01T00:00:00+00:00

Urgent Security release

In response to an XML External Entity (XXE) Injection vulnerability we have released OpenCats v0.9.4-3.

Overview

OpenCats suffers from an unauthenticated xml external entity injection that allows remote users to read files on the underlying operating system.

Date Reported: 28 Jun 2019

More information:

OpenCats XML External Entity (XXE) Injection

Remote users (job applicants) can upload docx or odt files to read files on the underlying operating system. A docx file will be used here, but odt files can be used as well since the same vulnerable functions in DocumentTotext.php are used to parse the files.

Remediation

This problem has been fixed in version 0.9.4-3

We recommend that you upgrade your opencats instance asap.

If you wish to apply a fix instead, please view the changes which requries you to add a single line to /lib/DocumentToText.php

Thanks

We are extremely grateful to Mark Ruther for finding this vulnerability and notifying the OpenCATS project.

Support queries?

If you have any questions regarding this security fix, please visit the User support forums or if you have found an issue with the code - then raise an issue on github

0.9.4 Release announcement

2017-05-12T00:00:00+00:00

Introduction

OpenCATS is the leading open-source Applicant Tracking System for recruiters and companies. It is the ongoing result of the community’s hard work and collaborative development since it was forked from the original base project (which moved into a closed-source SAAS model). This version of OpenCATS provides a number of new features, addresses critical security concerns, and maintains compatibility with current releases of PHP and MySQL..

ACL system for role-based restrictions

It is now possible to configure granular permissions for users based upon their roles and permit/restrict access to specific sections of the application. This is configured in the global configuration file config.php

Replacement of TinyMCE with CKEditor

All references to TinyMCE have been removed and it’s replaced in it’s entirety throughout the application with the current version of CKEditor.

Zipcode lookup via google.

When adding in new candidate or contact details, the address details will auto-populate using a lookup to google services. Note that some formatting varies per country. Currently this is tested for USA / Europe.

Working hard for the future

We’re well along the path for the next major version, too - moving to the Symfony framework and with a refreshed GUI based on bootstrap.

Changelog

The full details of the release (including changelog) are at https://github.com/opencats/OpenCATS/releases/tag/0.9.4

Thank you to the developers

The unsung heroes are the developers who have put an immense amount of personal time into maintaining and enhancing this project. You can find them in the release notes.. Every single one of them should be honoured!

Come and help!

If you want to out with the brand new challenges of OpenCATS as it migrates to Symfony and Bootstrap - please view the project on github and lend a hand. We actively monitor github issues, and regularly collaborate on slack.

https://github.com/opencats/OpenCATS https://github.com/opencats/OpenCATS/discussions

Support queries?

If you’ve deployed OpenCATS and have a support query, please visit the User support forums or if you have found an issue with the code - then raise an issue on github

ALternatively, you can email me night or day - russh@opencats.org

Thanks,

The OpenCATS team!

Newsletter #2 - A good journey

2016-12-01T00:00:00+00:00

Welcome to the second newsletter for opencats.

Playing Catch Up

Let’s take a look at some of the milestones of the previous six months;

General News

A re-energised and active Developer team actively working to improve base code and functionality.
several new features introduced including candidate address completion by zipcode, customisable job-codes, and configurable levels for users.
Installation and User documentation is now standardised into a readthedocs site , viewable online and easily printed to PDF.

Development News

Several deprecated errors corrected,
license is clarified
code deployment is now far more robust - Travis CI runs test-cases for each PR, and codacy automatically reviews the code quality

At 20,000 Feet

You may be wondering, “just how much has changed since it forked from CATS?” Well, let’s look at the overall changelog

Changelog

Unreleased

Full Changelog

Closed issues:

datagrid.php has strict errors (solved) and Deprecated errors on some tabs #155
Composer needs to be manually run even on a normal install #154
Including Candidates name while sending emails from ATS #133
Missing packages and modules #102
Update License #98
Canadian Postal Codes #38
TODO: add in Wordpress front-end from Ultrasimplified #12

Merged pull requests:

Update LICENSE.md #170 (RussH)
Zipcode address completion via google #167 (RussH)
Fixes error with globalStyle not being defined #166 (Bloafer)
Strict standards: Non-static method #165 (Bloafer)
Pass by Ref error on Strict Standards #164 (Bloafer)
Configurable Job Types #159 (skrchnavy)

0.9.3-3 (2016-11-22)

Full Changelog

Closed issues:

Powered by CATS pic on Careers Page does not appear correctly #139
While sending email to candidates the body field does not appear #131
Notice: Undefined variable: commandResult #105

Merged pull requests:

Generate packages with full dependencies on Travis #162 (mlespiau)
Extended xml export #158 (skrchnavy)
Logging into DB fix #157 (skrchnavy)
Remove references to pro version and links to downloads page #151 (cptr13)
Fix of attachments processing #149 (skrchnavy)
Fixes in db shcema #148 (skrchnavy)
Fixed Favicon.ico now showing #143 (amaisonneuve)
Powered By broken link #142 (amaisonneuve)
Upgraded ckeditor to current (version 4.5.11) to address #131 #132 (RussH)
Access level tests #125 (skrchnavy)
Update InstallationTests.php #124 (theSlyest)
Replace deprecated simpletest with phpunit and behat #123 (mlespiau)
Tests using behat isolated in test directory #100 (skrchnavy)

0.9.3-2 (2016-11-22)

Full Changelog

Closed issues:

Feature Request - add a ‘is Hot?’ column to cold call list #161
500 error while creating a company or job order #160
How can I access to my opencats web in the vps from another pc #146
Forgot Password link in the login screen missing #141
Content area turns blue when something is added #140
500 Error after install #138
Error while creating http://localhost/opencats #129
Resume Upload error #126

0.9.1a (2016-08-26)

Full Changelog

0.9.3-1 (2016-08-26)

Full Changelog

Closed issues:

No actions work against list members in 0.9.3 #121

Merged pull requests:

fixed send email and add candidates #122 (skrchnavy)

opencats-0.9.3(alpha) (2016-08-22)

Full Changelog

opencats-0.9.3(final) (2016-08-22)

Full Changelog

Closed issues:

Troubleshoot MySQL #111
Non editable “paste the resume contents” field #104
Issue with vagrant #103
Windows installation #99
From Forums - Manuel’s attachment issue #95
asp File in module #69
ElementITMultiPowUpload1.7.swf #68
Unable to login #64
i need to change menu names #63
Sync from Uservoice #24
TODO: add in fixes from Debian packaging #10

0.9.3 (2016-03-09)

Full Changelog

Closed issues:

Add JobOrder available for ReadOnly user on Job Orders page #109
Add Candidate available for ReadOnly user on Candidates page #107
Add Contact available for ReadOnly user on Contacts page #101
Cannot import any data. New Unit test? #86
Initial sign-in, cookie error #85
Tests do not run #70
Use fluid width pages #58
Update installation procedure #57
Initial password displayed in installer page is wrong #53
Plain Text Password #45
Decoding of UTF-8 characters mangles Calendar entries #42
update phpmailer to more recent version #37
disable the catsone.com version check #35
update exceptions table with two additional fields or it’ll throw errors #28
Include updated SVG artwork #21
Default username wrong #19
TODO: add in LDAP integration from LIBREGEEK #11
Incompatibility with Explorer 11 in the editor #2
datepicker returns the wrong default date when adding activities #1

Merged pull requests:

update version no / name to 0.9.3 Inferno #119 (RussH)
updated styling for login screen #117 (RussH)
Checks for access level #114 (skrchnavy)
Fix of permission in Job Orders for readOnly user #110 (skrchnavy)
Fix of permission in candidates for readOnly user #108 (skrchnavy)
Fix of permission in contacts for readOnly user #106 (skrchnavy)
Waffle badges in README #96 (skrchnavy)
fixes some typo errors #92 (skrchnavy)
docker - added execute permission for installing composr #90 (skrchnavy)
Wait for mysql and apache before running tests in travis #89 (mlespiau)
Issue 86 cannot import data after initial setup #88 (mlespiau)
Datagrid filters ui refactor and bugfixes #87 (mlespiau)
Fixed issues with UTF8 #84 (skrchnavy)
Mysql utf8 character set #81 (mlespiau)
Add cucumber like functional tests #80 (mlespiau)
Docker for development #78 (mlespiau)
Flexible layout #74 (mlespiau)
Ldap module improvements #73 (skrchnavy)
Fix unit tests #72 (mlespiau)
Replace GroupTest class with TestSuite as it was removed from Simplet… #71 (mlespiau)
Added grave accents, backticks, to database schema name #66 (aaam)
Update lib.js #62 (theSlyest)
Update suggest.js #61 (theSlyest)
Fixed #57 - Updated documentation. Fixed #45 - Added md5 encryption to passwords. #59 (libregeek)
Updated phpmailer library refer #37 #56 (vinay-athiyil)
LDAP authentication support and default password display #54 (libregeek)

opencats-0.9.3 (2016-03-09)

Closed issues:

OpenCATS vs CandidATS #46
Strict standards: Only variables should be passed by reference in D:\wamp\www\cats\lib\DataGrid.php on line 1714 #39
Error in config.php for email settings #34
Cannot generate report on CATS 0.9.2 #33
Error while trying to generate report from Jobs view #31
Cats freezes/stops working when creating candidate #30
Sync from Uservoice #27
Disable Modules #26
issues on UI application #22
CATS references in Install Wizard #16
Sync from Uservoice #15
Add in latest PHP fixes from crossgate9 #14
Add in updated and enhanced Sphinx Search from Allan Jones #13
When editing a company the fields at the right side isn’t lined up well #8
Missing Icon in calandar #7
Deprecated error in Opencats #5

Merged pull requests:

Update from RussH fork #49 (RussH)
Make CSV exports in UTF-8 readable for Excel #41 #48 (wjcheers)
Fix bug and add duplicated phone number check. #47 (wjcheers)
removing the old superseded simpletest library #20 (RussH)
Updated SQL to ensure tag db is created. #18 (RussH)
Please merge Opencats fixes as below #17 (RussH)

Newsletter #1 - A New Hope

2014-06-06T00:00:00+00:00

Welcome to the first newsletter for Opencats, a project that hopes to give a new beginning to an ATSthat we all love.

Playing Catch Up

Let’s take a look at some of the milestones of the months preceding May:

General News

March 20:

Development News

Imported source code was cleaned up.
Legacy system support was removed.

At 20,000 Feet

You may be wondering, “just how much has changed since it forked from CATS?” Well, let’s look.

Recent Development

Now that we have detailed some of the milestones before the month of May started, we can now look at what has happened in the last month.