TI-2021-16559 Aliases CVE-2021-39173 GHSA-r67m-m8c7-jp83

Forced reinstall

MEDIUM 43CWE-704Published 2021-08-27 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-704 and the CVSS impact.

Summary

Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.

Why it matters now

EPSS 0.02362 83rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Cachet (fiveai): 2.5.1cachethq/cachet (Packagist): 2.5.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fiveai	Cachet	before 2.5.1	2.5.1	Patch available	CNA
—	cachethq/cachet (Packagist)	before 2.5.1	2.5.1	Patch available	GHSA-r67m-m8c7-jp83

Cachet Vendorfiveai Affected before 2.5.1 Fixed in 2.5.1 Patch available CNA
cachethq/cachet (Packagist) Vendor— Affected before 2.5.1 Fixed in 2.5.1 Patch available GHSA-r67m-m8c7-jp83

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:catchethq:catchet::::::::	before 2.5.1	Vulnerable	Catchethq

cpe:2.3:a:catchethq:catchet:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·Catchethq

Remediation

Fix · CNA Cachet (fiveai) Fixed in 2.5.1
Fix · GHSA-r67m-m8c7-jp83 cachethq/cachet (Packagist) Fixed in 2.5.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-39173
2026-10-03 Alias added: GHSA-r67m-m8c7-jp83

References

Exploit 1

https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/

Advisory 3

Other 2

TI-2021-16558 New line injection during configuration edition CVSS 3.1HIGH 8.8
TI-2021-16560 Configuration leak CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences