CVE-2026-69118: Cachet RCE Vulnerability

CVE-2026-69118 Overview

CVE-2026-69118 is a server-side template injection (SSTI) vulnerability in Cachet, an open-source status page system, affecting versions through 2.4.1. The flaw resides in incident template rendering, where authenticated users can embed malicious Blade directives or Twig filters into incident templates. When the application renders an incident based on these templates, the injected payload executes as arbitrary PHP code on the server. Successful exploitation grants remote code execution (RCE) under the web server process, mapping to [CWE-863: Incorrect Authorization]. The issue is tracked in GitHub Issue #4621 and detailed in the VulnCheck Security Advisory.

Critical Impact
Authenticated attackers can achieve remote code execution on Cachet servers, compromising status page infrastructure and any credentials or data available to the PHP process.

Affected Products

Cachet status page system, all versions through 2.4.1
Deployments exposing incident template management to authenticated users
Self-hosted Cachet instances running on PHP with Blade or Twig rendering enabled

Discovery Timeline

2026-08-10 - CVE-2026-69118 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-69118

Vulnerability Analysis

Cachet renders incident content through a templating pipeline that evaluates Blade directives and Twig filters. The incident template feature accepts user-supplied template strings intended for reuse when creating incidents. The application passes these strings directly into the template engine without sanitization or sandboxing. Any authenticated user with permission to manage incident templates can therefore inject template syntax that the engine executes as PHP.

When an incident is subsequently created from a poisoned template, the engine resolves the injected directives at render time. Payloads can invoke PHP functions such as system, exec, or passthru through Blade's raw expression syntax or through Twig filter chains. Execution occurs inside the web application process, giving attackers the same privileges as the PHP runtime.

Root Cause

The root cause is unsafe evaluation of user-controlled template content. Incident template rendering treats stored templates as trusted server-side code rather than untrusted input. The authorization model does not restrict the template syntax available to authenticated editors, so any account with template-editing rights can reach the sink.

Attack Vector

Exploitation requires an authenticated Cachet account with permission to create or modify incident templates. The attacker stores a malicious template containing Blade or Twig payloads that resolve to PHP function calls. Triggering an incident that uses the template causes the engine to execute the injected code. Because the attack path traverses the normal web interface, no network-level access beyond HTTPS to the Cachet instance is required.

See the VulnCheck Security Advisory for technical details of the injection sinks.

Detection Methods for CVE-2026-69118

Indicators of Compromise

Unexpected child processes such as sh, bash, php, or curl spawned by the Cachet PHP-FPM or web server worker.
Incident templates containing Blade raw expressions like {!! ... !!} or Twig filters referencing system, exec, shell_exec, or passthru.
Outbound network connections from the Cachet host to unfamiliar destinations shortly after incident creation.
New or modified files under the Cachet web root, particularly PHP files outside expected directories.

Detection Strategies

Review incident template records in the Cachet database for suspicious template syntax before and after the upgrade.
Enable PHP disable_functions auditing and log invocations of high-risk functions from web request contexts.
Alert on process lineage where the PHP or web server user spawns shell interpreters or reconnaissance binaries.
Correlate incident creation events with subsequent process, file, and network activity on the Cachet host.

Monitoring Recommendations

Ingest Cachet application logs, web server access logs, and host process telemetry into a centralized SIEM.
Track authentication events for accounts with incident template privileges and flag anomalous logins.
Baseline normal outbound traffic from the Cachet server and alert on deviations.
Monitor for modifications to files in the Cachet installation directory outside of scheduled deployments.

How to Mitigate CVE-2026-69118

Immediate Actions Required

Upgrade Cachet to a patched release later than 2.4.1 once available from the Cachet project.
Audit all existing incident templates and remove any containing template directives or filter expressions.
Revoke incident-template privileges from accounts that do not require them and reset credentials for users who did.
Restrict administrative access to the Cachet interface behind a VPN or IP allow list where feasible.

Patch Information

A fix is being tracked in GitHub Issue #4621. Administrators should monitor the Cachet repository for a release that sanitizes incident template content and applies context-aware escaping in the rendering pipeline. Until a fixed version is deployed, treat any Cachet instance running 2.4.1 or earlier as vulnerable.

Workarounds

Restrict the incident template management role to a small set of trusted administrators.
Place the Cachet application behind a web application firewall with rules that block Blade and Twig syntax in POST bodies to template endpoints.
Run the PHP process under a low-privilege system account with disable_functions set to block system, exec, shell_exec, passthru, and proc_open.
Isolate the Cachet host on a segmented network with strict egress filtering to limit post-exploitation options.

bash

# Example php.ini hardening for Cachet hosts
disable_functions = system,exec,shell_exec,passthru,proc_open,popen,pcntl_exec
allow_url_fopen = Off
allow_url_include = Off
open_basedir = /var/www/cachet:/tmp