CVE-2021-39172

CVE-2021-39172 describes a critical vulnerability in Cachet, an open-source status page system, affecting versions prior to 2.5.1. Authenticated users, even those with low-privilege "User" roles, can achieve arbitrary code execution on the server through a new line injection flaw in the configuration editing feature, specifically within mail settings. This vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low attack complexity and high impact on confidentiality, integrity, and availability. While the EPSS score is high, suggesting potential exploitability, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB) and no evidence of active exploitation or significant community discussion.