Cacti
CVE-2025-24367
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | CVSS 8.7, EPSS 90.5%, PoC available, patch available. Cacti is widely deployed for network and infrastructure monitoring in enterprises. Monitoring systems typically have broad network access, making them high-value pivot points. Even low-privilege Cacti users can exploit this. |
| Exploit ScenarioDerived | A compromised or malicious monitoring operator with basic Cacti graph creation permissions crafts a graph template that writes a PHP webshell to the web root. They access the webshell via HTTP, gaining OS-level access to the Cacti server. From there, they leverage the server's SNMP credentials and network monitoring access to map and compromise the entire infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
Cacti monitoring platform prior to version 1.2.29 allows authenticated users to achieve remote code execution through the graph creation and template functionality. Attackers abuse the graphing engine to create arbitrary PHP scripts in the web root, escalating from monitoring access to full server control.
Earlier versions of this analysis (1)
Authenticated RCE in Cacti via graph template abuse allows creation of arbitrary PHP files in the web document root.
RemediationAI
Update to Cacti 1.2.29. Restrict graph template creation to trusted administrators only. Configure the web server to deny PHP execution in graph output directories. Monitor the web root for unexpected PHP file creation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The graph creation workflow allows users to define custom graph templates with data source paths. By manipulating the template parameters, an authenticated user can cause the graphing engine to write PHP code into files within the web root directory. The crafted graph template generates a valid PHP script instead of a graph image, which can then be accessed directly via HTTP.
Know when Cacti gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
Executive ViewAI
Organizations using Cacti face significant risk from CVE-2025-24367 rated CVSS 8.7. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. With an EPSS score of 90%, this vulnerability faces very high likelihood of exploitation. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management fram
Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerabil
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB).
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. Rated high se
Cacti is an open source operational monitoring and fault management framework. Rated critical severity (CVSS 9.8), this
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary S
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQ
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitra
Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerabil
Cacti is an open source operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vuln
Cacti is an open source operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vuln
Same weakness CWE-144 – Improper Neutralization of Line Delimiters
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Package Hub 15 SP6 | Fixed |
Exploit-DB