CVE-2026-113712

Name of the Vulnerable Software and Affected Versions Cachet versions prior to 2.4.2 Cachet version 3

Description A stored Cross-Site Scripting (XSS) issue exists in the incident creation form. An authenticated attacker can inject malicious HTML or JavaScript into the Incident Name and Incident Message fields at the /dashboard/incidents/ endpoint. This occurs because the system fails to properly sanitize HTML event handler attributes. The injected code executes in the browser of any user viewing the public status page, which can lead to session token theft, XSRF token theft, and full account takeover, including administrator accounts.

Recommendations For versions prior to 2.4.2, apply the patches provided in commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in cachethq/core. For version 3, restrict access to the /dashboard/incidents/ endpoint or avoid using the Incident Name and Incident Message fields until a fix is applied. As a temporary mitigation, restrict the ability of users to create incidents via the /dashboard/incidents/ endpoint.