CVE-2025-24367HIGH 8.8EPSS p98.7%

CVE-2025-24367CVE-2025-24367

Description

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS49.09% probability of exploitation · percentile 98.7% · 2026-06-18T12:00:27Z
Published2025-01-27
Last modified2025-11-03

Underlying weaknesses· 1

CWE-144

References

  1. https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
  2. https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq
  3. https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
  4. https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Line Delimiterscwe-1440%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-26520
CVE
CVE-2022-46169
CVE
CVE-2025-66399
CVE
PHP-CGI OS Command Injection Vulnerability
CVE
CVE-2025-41736
CVE
Craft CMS Code Injection Vulnerability
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.