CVE-2025-24367

Cacti allows Arbitrary File Creation leading to RCE

State: Published
Severity: 8.7 High
Published: Jan 27, 2025
Updated: Nov 3, 2025
Reserved: Jan 20, 2025

Description

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-144 Improper Neutralization of Line Delimiters

Affected Products

Product	Versions
cactiCacti	<= 1.2.28Affected

References

https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq
https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.