Is cachethq/cachet affected by CVE-2026-113712?

Packagist cachethq/cachet is affected in <= 2.4.1.

Is CVE-2026-113712 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.5%.

medium

CVE-2026-113712

Q: Is CVE-2026-113712 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.5%.

Packagist · cachethq/cachet

Summary

Cachet has Stored XSS in Incident Component

Severity: medium
EPSS: 0.5% (p40)
CWE: CWE-79
Also known as: GHSA-x397-5hrv-j9m9
Published: 2026-10-20
Updated: 2026-10-20

Advisory details

Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.

Details

The incident Name and Message fields do not properly sanitize HTML event handler attributes. While