CVE-2026-113712 Details
Description
Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.
A stored cross-site scripting (XSS) vulnerability has been identified in Cachet, an open-source status page system, affecting versions through 2.4.1. The issue resides in the incident creation form, where the Incident Name and Message fields fail to properly sanitize HTML event handler attributes. This allows authenticated attackers to inject malicious HTML or JavaScript that executes in the browsers of users viewing the status page. Exploitation of this vulnerability could lead to session token theft and account takeover.
Users can update to the patched version of Cachet, which is available in the main branch of the cachethq/core repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9 | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2 | [email protected] | Source CodeVendor |
| https://github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cachet | < 23adbb8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |