CVE-2025-24367

Published: Jan 27, 2025Modified: Jun 17, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

Affected (1)

Products: Cacti: Cacti

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cacti Cacti	Before 1.2.29

Related CWEs

Improper Neutralization of Line Delimiters

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.

References (4)

https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0

Source: security-advisories@github.com

Patch

https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq

Source: security-advisories@github.com

ExploitVendor Advisory

https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.