CVE-2025-24367: cacti
Vulnerability summary
CVE-2025-24367 is a high (CVSS 8.8) vulnerability in cacti. EPSS estimates a 54.02% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 27-01-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
54.02%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 54.02% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundCacti
Maturity: poc
Cacti Graph Template authenticated RCE versions prior to 1.2.29
exploit/multi/http/cacti_graph_template_rce
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Cacti1 product
- cacti≤ 1.2.28 | < 1.2.29
Debian1 product
- cacti< 1.2.24+ds1-1+deb12u5 | < 1.2.28+ds1-4
Ubuntu1 product
- cactiAll versions (No fix recorded)
3 vendors · 3 products
References
6 links- github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqqX Refsource CONFIRMREPORTExploitVendor Advisory
