TL;DR: Cachet through version 2.4.1 lets any authenticated user plant Blade or Twig directives inside incident templates. When Cachet renders an incident using that template, the template engine executes the payload as PHP, giving the attacker remote code execution as the web server process. Update to Cachet 3.x or patch the template rendering layer. No fix exists for the 2.x branch.

What happened

The attack chain starts with an authenticated user who has permission to create incident templates. Cachet stores these templates as raw strings and later passes them through Laravel's Blade engine or Twig without escaping or sandboxing. An attacker writes a Blade directive like @system('id') or a Twig filter like {{ system('whoami') }} into the template body. The next time an incident references that template, Cachet compiles and executes it. The PHP process runs the command. That is remote code execution.

Cachet uses Laravel's Blade templating engine for its incident rendering pipeline. Blade treats anything wrapped in @ directives or {{ }} braces as executable PHP. The vulnerability exists because Cachet's incident template system stores user-supplied template content and feeds it directly to Blade without applying any output escaping or directive filtering. The same input path also accepts Twig syntax when the Twig bridge is enabled, doubling the attack surface.

The CVSS 4.0 base score is 8.7 (HIGH). The vector is AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H. Network-reachable, low complexity, low privileges required. The attacker needs an authenticated account, but Cachet instances often have self-registration enabled or shared team credentials. One low-privilege user compromises the entire server.

Who is affected

Cachet is an open-source, self-hosted status page system built on Laravel. The repository at github.com/cachethq/cachet has 15,100+ GitHub stars and 170 contributors. The official site reports 1M+ downloads. Organizations use Cachet to display service uptime, incidents, and maintenance schedules to their customers. Universities, SaaS companies, and hosting providers are the typical deployers.

All versions through 2.4.1 are affected. The latest 2.x release is v2.4.1, published November 2023. The 3.x branch (default branch on GitHub) is a ground-up rewrite that does not share the vulnerable template rendering code. If you are running any 2.x version, you are exposed.

The NVD classifies this under CWE-863 (Incorrect Authorization) and CWE-1336 (Incorrect Container Scoping). The authorization issue is that any authenticated user, regardless of role, can submit incident templates. The scoping issue is that template content escapes the intended rendering boundary and executes as application code.

What to do

Three options, in order of preference:

1. Migrate to Cachet 3.x. The 3.x branch is a complete rewrite on Laravel 10 and does not accept raw Blade/Twig in incident templates. This is the only path that fully eliminates the vulnerability class.
2. Restrict template creation access. If you cannot migrate immediately, remove template creation permissions from all users except a single trusted administrator. In Cachet 2.x, edit app/Models/User.php and add a guard in the canManageIncidentTemplates() method.
3. Deploy a WAF rule. Block incoming requests that contain Blade directives (@system, @exec, @eval) or Twig function calls (system(, exec() in template body fields. This is a mitigation, not a fix.

There is no patched 2.x release. The maintainers have not committed a fix for the 2.x branch as of the disclosure date.

Why it matters

Status pages are public-facing infrastructure that organizations rely on during incidents. A compromised status page is uniquely dangerous: the attacker can publish false information about service outages, and they gain a foothold on a server that often shares a network with production systems. The psychological impact of a defaced or manipulated status page during a real outage compounds the technical damage.

Cachet deployments are frequently self-hosted on minimal VPS instances with limited hardening. The PHP process running Cachet often has access to database credentials, API keys, and environment variables. RCE on a Cachet instance typically leads to lateral movement within hours.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69118
• Cachet GitHub issue: https://github.com/cachethq/cachet/issues/4621
• VulnCheck advisory: https://www.vulncheck.com/advisories/cachet-authenticated-server-side-template-injection-rce
• HOL Guard: https://hol.org/guard/security/cves/CVE-2026-69118