Cachet EUVD-2026-55800

Exploitation requires a valid, authenticated Cachet user account with permission to create or edit incident templates, corresponding to PR:L in the CVSS vector - any team member role that grants template editing access is sufficient. The target instance must be running Cachet version 2.4.1 or earlier; no non-default server configuration is required beyond a standard Cachet deployment with the incident template feature active. Exploitation is bounded by the authentication requirement: unauthenticated external attackers must first obtain valid credentials through credential stuffing, phishing, or account compromise before exploiting this vulnerability. No victim-side user interaction is required once the malicious template is in place.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H reflects network-accessible exploitation at low complexity, with low-privilege authentication as the sole access barrier - a meaningful but surmountable control. With a public proof-of-concept already circulating and no CISA KEV listing, exploitation appears opportunistic rather than confirmed as widespread; even so, even a mid-sized municipal IT team in walbrzych running Cachet for internal service status communication should treat this as urgent given that any invited team member account clears the authentication threshold. The combination of public exploit code, network accessibility, low attack complexity, and full high-impact triad across confidentiality, integrity, and availability makes this a genuine remediation priority for any organization with Cachet deployed. No EPSS score was provided in the source data, and no conflicting signals were identified between the CVSS vector and the vulnerability description.

An attacker with a low-privilege Cachet account - such as a team member invited to manage incidents - navigates to the incident template editor and creates a template embedding a Blade directive such as @php system($_GET['cmd']); @endphp. When any incident is subsequently created or previewed using that template, the PHP interpreter executes the injected command as the web server process, granting the attacker arbitrary OS-level code execution. A public proof-of-concept demonstrating this technique has been confirmed by VulnCheck, substantially lowering the skill barrier for exploitation.