Description

Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achieving remote code execution as the web server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T20:17:32.310Z",
  "pubdate": "2026-08-10T20:17:32.310Z",
  "executiveSummary": "Cachet through version 2.4.1 suffers from a server-side template injection vulnerability residing within the incident template rendering functionality. This security flaw enables authenticated users to inject arbitrary PHP code, leading to remote code execution within the context of the web server process.\nThe vulnerability poses a severe risk to confidentiality, integrity, and availability, as successful exploitation allows attackers to execute arbitrary system commands on the underlying host operating system.\nExploitation requires authenticated access to the application and the ability to create or modify incident templates. Threat actors leverage malicious payloads containing template directives to bypass input sanitization mechanisms during the template compilation and rendering phases.\nOrganizations utilizing affected versions of Cachet face immediate risk of full system compromise if malicious actors gain unauthorized access to an authenticated session with template management privileges.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure handling and evaluation of user-supplied data within the incident template rendering engine of Cachet through version 2.4.1.\nThe vulnerable component is responsible for processing template syntax, specifically failing to adequately sanitize or sandbox inputs prior to rendering.\nAuthentication is required to exploit this vulnerability, as attackers must access the incident template creation or modification interface within the application.\nPrivilege requirements include administrative or standard user capabilities that permit the creation of incident templates.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a malicious incident template incorporating specific template syntax, such as Blade directives or Twig filters, designed to evaluate arbitrary PHP code or system commands. Second, the attacker submits this payload via the incident template creation interface. Third, when an incident referencing the template is subsequently created or rendered, the application engine processes the injected directives without proper isolation. Finally, the template engine evaluates the malicious syntax, resulting in the execution of arbitrary system commands executed under the privileges of the web server process.\nPost-exploitation impact includes full remote code execution, potential lateral movement within the network, access to sensitive configuration files, and complete compromise of the underlying host infrastructure."
}