CVE-2026-113712
MediumCVSS 4.8Summary
Cachet versions 2.4.1 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form. An authenticated attacker can inject malicious HTML/JavaScript that executes in the browser of any user viewing the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in cachethq/core patch the issue.
Risk Assessment
An attacker with a valid account can execute scripts in other users' browsers, including administrators, risking session hijacking and further privilege escalation. The public status page increases attack reach.
Recommendation
Update Cachet to a version containing the referenced fix commits or deploy the latest release. Additionally, consider enforcing Content-Security-Policy headers to limit script execution.
Other vulnerabilities in Cachet
See all- CVE-2023-43661High
Cachet, an open-source status page system, prior to the 2.4 branch contains a template functionality that allows users to execute arbitrary code on the server due to bad filtration and an old Twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.
- CVE-2026-69118High
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering. Authenticated users can create malicious incident templates with Blade directives or Twig filters that execute system commands, achieving remote code execution as the web server process.
Original NVD description (English source)
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS