CVE-2023-43661

HighCVSS 8.8

Published: 11/10/2023(UTC)Updated: 20/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

51.48%

99th percentile - higher than 99% of all known CVEs

Summary

Cachet, an open-source status page system, prior to the 2.4 branch contains a template functionality that allows users to execute arbitrary code on the server due to bad filtration and an old Twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

Risk Assessment

A user able to create templates can execute arbitrary code on the server, leading to full compromise of the application and host. The risk is high in environments with multiple users having template permissions.

Recommendation

Upgrade Cachet to the 2.4 branch containing commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 or later. Restrict template creation permissions to trusted administrators.

Other vulnerabilities in Cachet

CVE-2026-69118High
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering. Authenticated users can create malicious incident templates with Blade directives or Twig filters that execute system commands, achieving remote code execution as the web server process.

Original NVD description (English source)

Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS