---
id: CVE-2023-43661
title: Cachet vulnerable to Authenticated Remote Code Execution
summary: >-
  Cachet is an open-source status page system. Prior to the 2.4 branch, a
  template functionality which allows users to create templates allows them to
  execute any code on the server during the bad filtration and old twig version.
  Commit 6f…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-94
vendor: cachethq
product: cachet
affected:
  - cachet < 2.4
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-17T13:45:32.334926Z'
exploitAvailable: true
published: '2023-10-11'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:55:57.760Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-43661'
references:
  - url: 'https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p'
    label: 'https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p'
  - url: >-
      https://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587
    label: >-
      https://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587
tags:
  - cve.org
  - exploit-available
epss: 0.51481
epssPercentile: 0.98937
ingestedAt: '2026-10-20T19:16:14.381Z'
---

## Overview

Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

## Affected

- `cachet < 2.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.