CVE-2023-43661

Cachet is a tool businesses use to show a public status page (like 'all systems operational') for their services. This flaw means someone who already has a regular account on your Cachet system — not a random outsider — can use the page-template feature to trick the server into running their own commands, similar to a tenant with a key to one room using a hidden trick to unlock every door in the building.

This matters to you if you run Cachet (cachethq/cachet) to host your own status page, especially versions before 2.4. It only poses a risk if an attacker already has at least a low-privileged login on your Cachet instance — a stranger with no account cannot exploit it directly.

This isn't being actively exploited in the wild right now, but a public proof-of-concept exists and attention to this flaw is rising, so it's a real and growing risk rather than a theoretical one. Treat it as a priority to fix soon, especially if you have multiple users with accounts on your status page.

Confirm your Cachet version via the admin panel or composer.lock; any version prior to the 2.4 branch is vulnerable. Upgrade to Cachet >= 2.4 (Packagist cachethq/cachet >= 2.4), which includes the fix from commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 addressing the Twig template engine filtering issue. If immediate upgrade isn't feasible, apply the patch commit manually or follow the mitigation steps in the vendor's GHSA-hv79-p62r-wg3p advisory, and in the interim restrict/audit who holds user accounts on the instance since exploitation requires an authenticated low-privilege session. No CISA KEV due date applies since this is not yet listed in KEV. Monitor for anomalous template-creation activity and unexpected outbound server processes post-upgrade, and watch for any future KEV listing or exploitation reports given the rising EPSS trend and public PoC.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — network-exploitable, low complexity, requires low-privilege auth, no user interaction, full impact on confidentiality/integrity/availability. CWE-94 (Code Injection) and CWE-74 (Injection) via an outdated Twig template engine with inadequate input filtering in the template-creation feature. A public PoC exists on GitHub; not currently in CISA KEV. EPSS is elevated and trending upward, indicating rising likelihood of future exploitation attempts, though no confirmed in-the-wild exploitation has been reported yet.