High severity · published Jan 27, 2025
CVE-2025-24367
Cacti is an open source performance and fault management framework
8.8
CVSS
54.3%
EPSS
No
On KEV
Description
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)54.3% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
before 1.2.29 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24367
Patch
https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
Exploit
https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
9.8
CVE-2026-39938
Cacti: Unauthenticated RCE on Graph Image