TI-2023-23386 Aliases CVE-2023-43661 GHSA-hv79-p62r-wg3p

Cachet vulnerable to Authenticated Remote Code Execution

HIGH 71CWE-94Published 2023-10-11 · Updated 2026-10-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.49232 98th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed cachet (cachethq): 2.4cachethq/cachet (Packagist): 2.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cachethq	cachet	before 2.4	2.4	Patch available	CNA
—	cachethq/cachet (Packagist)	before 2.4	2.4	Patch available	GHSA-hv79-p62r-wg3p

cachet Vendorcachethq Affected before 2.4 Fixed in 2.4 Patch available CNA
cachethq/cachet (Packagist) Vendor— Affected before 2.4 Fixed in 2.4 Patch available GHSA-hv79-p62r-wg3p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:all-three:cachet::::::::	before 2.4	Vulnerable	All-three

cpe:2.3:a:all-three:cachet:*:*:*:*:*:*:*:* Versions before 2.4 Vulnerable ·All-three

Remediation

Fix · CNA cachet (cachethq) Fixed in 2.4
Fix · GHSA-hv79-p62r-wg3p cachethq/cachet (Packagist) Fixed in 2.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-43661
2026-10-03 Alias added: GHSA-hv79-p62r-wg3p

References

TI-2026-77002 Stored cross-site scripting in Cachet incident form CVSS 4.0MEDIUM 4.8
TI-2026-48523 Cachet 2.4.1 Authenticated Server-Side Template Injection RCE CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences