Vulnerability record · CVE-2023-43661 · published 11 October 2023
CVE-2023-43661: Cachet template feature allows server-side code execution
AAll Three · Cachet
Cachet, an open-source status page system, lets users create templates that are rendered with an outdated Twig version and inadequate input filtering. This allows code injection so that a user with template-creation rights can execute arbitrary code on the server. The flaw affects versions prior to the 2.4 branch and is fixed in commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587.
Description
Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with low privileges and no user interaction, plus a high EPSS score and an exploit-tagged advisory, make this a serious remote code execution risk despite no KEV listing.
What it is
Cachet, an open-source status page system, lets users create templates that are rendered with an outdated Twig version and inadequate input filtering. This allows code injection so that a user with template-creation rights can execute arbitrary code on the server. The flaw affects versions prior to the 2.4 branch and is fixed in commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587.
Impact
An attacker with the ability to create templates gains remote code execution on the Cachet server, leading to full compromise of confidentiality, integrity and availability. This can expose status page data, credentials and the underlying host.
Attack surface
The vulnerability is reachable over the network through the template functionality; the CVSS vector indicates low privileges are required and no user interaction is needed. The attacker must have an account or role that permits template creation.
Exploitation
The vendor advisory is tagged Exploit, but the CVE is not listed in CISA KEV and no ransomware use is documented. EPSS is high at 0.46904 (98.8th percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Upgrade Cachet to the 2.4 branch or apply commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 immediately.
- Restrict template-creation permissions to trusted administrators only.
- Review and remove any untrusted or unnecessary custom templates.
- If patching is delayed, disable the template functionality or isolate Cachet from sensitive networks.
Detection
- Monitor Cachet logs for template creation or modification events, especially by non-admin users.
- Look for unexpected outbound connections or child processes spawned by the Cachet web server.
- Audit server filesystem and process activity for signs of code execution originating from the Cachet application.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587 | Patch |
| https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p | ExploitMitigationVendor Advisory |
| https://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587 | Patch |
| https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p | ExploitMitigationVendor Advisory |
Track CVE-2023-43661 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-43661), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
