CVE-2026-69118
Received Received - Intake

Cachet Server-Side Template Injection Leading to RCE

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achieving remote code execution as the web server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-69118
EUVD
EUVD-2026-55800

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cachet cachet to 2.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Cachet through 2.4.1 has a server-side template injection flaw in incident template rendering. Authenticated users can exploit this by creating malicious templates with Blade directives or Twig filters to execute arbitrary PHP code. When incidents are created, these templates run system commands, allowing remote code execution as the web server process.

Detection Guidance

Detecting this vulnerability requires checking for Cachet installations and reviewing incident templates for malicious Blade or Twig directives. Inspect template files in the Cachet application directory for unusual PHP or system commands. Check server logs for unexpected command execution patterns during incident rendering.

Impact Analysis

This vulnerability allows attackers with valid credentials to execute arbitrary code on the server. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. The impact depends on the server's role and data stored.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update Cachet to the latest version beyond 2.4.1. If updating is not possible, disable incident template rendering or restrict authenticated user permissions to prevent template modifications. Monitor server logs for suspicious activity and consider isolating the Cachet instance from critical systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69118. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart