CVE-2025-24367

EUVD-2025-3681
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 98.93%
Affected Products (NVD)
VendorProductVersion
cacticacti
𝑥
< 1.2.29
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cacti
bookworm
1.2.24+ds1-1+deb12u5
fixed
bookworm (security)
1.2.24+ds1-1+deb12u5
fixed
bullseye
unimportant
bullseye (security)
1.2.16+ds1-2+deb11u5
fixed
forky
1.2.31+ds1-2
fixed
sid
1.2.31+ds1-2
fixed
trixie
1.2.30+ds1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cacti
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
ignored
questing
ignored
resolute
not-affected
trusty
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq
https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq