Vulnerabilities

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.

Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146.

CVE-2025-24367 is an authenticated remote code execution flaw in Cacti, an open-source performance and fault management framework. A user with valid (low-privilege) credentials can abuse the graph creation and graph template functionality to write arbitrary PHP scripts into the application's web root; when those scripts are requested, the web server executes them. Successful exploitation yields remote code execution on the server with high impact to confidentiality, integrity, and availability, reflected in the CVSS 4.0 score of 8.7. Any organization running an affected Cacti version whose web interface is reachable by users who can authenticate is exposed, especially if the frontend is internet-facing. A public proof-of-concept exists via the vendor advisory (GHSA-fxrq-fr7h-9rqq); confirmed in-the-wild exploitation has not been reported and the flaw is not in CISA KEV, but EPSS assigns a 54% probability of exploitation within 30 days (99th percentile), so broad scanning is likely.

Do: Upgrade to Cacti 1.2.29 or later as soon as possible. Until patched, restrict access to the Cacti web interface, review which accounts hold graph-editing privileges, and check the web root for unexpected PHP files that may indicate prior exploitation. After upgrading, audit existing graphs and graph templates for tampering.

CVE-2024-43364 is a stored cross-site scripting (XSS) vulnerability in Cacti, an open-source performance and fault management framework, caused by insufficient sanitization of the 'title' parameter when saving external links in links.php. An attacker with the privilege to create external links can tamper with the 'title' parameter in the HTTP POST request; the injected value is stored in the database and later reflected back to users via index.php, where the script executes in their browsers. Successful exploitation allows arbitrary script execution in the context of authenticated Cacti users who view the affected pages, with scope-changing confidentiality, integrity, and availability impacts reflected in its 8.2 (High) CVSS score. All Cacti instances running versions before 1.2.28 are affected, and there are no known workarounds. There is no evidence of in-the-wild exploitation and it is not in CISA KEV, but a public advisory is available and EPSS assigns a 35.8% probability of exploitation within 30 days (98th percentile).

Do: Upgrade to Cacti 1.2.28 or later; there are no known workarounds, so patching is the only remediation. Until patched, restrict the privilege to create external links to trusted users and review existing external link titles for injected HTML or script. Given the elevated EPSS probability, prioritize updating internet-reachable Cacti servers.

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying password, it calls `compat_password_verify`. In `compat_password_verify`, `password_verify` is called if there is it, else use `md5`. `password_verify` and `password_hash` are supported on PHP < 5.5.0, following PHP manual. The vulnerability is in `compat_password_verify`. Md5-hashed user input is compared with correct password in database by `$md5 == $hash`. It is a loose comparison, not `===`. It is a type juggling vulnerability. Version 1.2.27 contains a patch for the issue.

Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.

SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php function.

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `reports_admin.php` displays reporting information about graphs, devices, data sources etc. _CENSUS_ found that an adversary that is able to configure a malicious device name, related to a graph attached to a report, can deploy a stored XSS attack against any super user who has privileges of viewing the `reports_admin.php` page, such as administrative accounts. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http:// /cacti/host.php`, while the rendered malicious payload is exhibited at `http:// /cacti/reports_admin.php` when the a graph with the maliciously altered device name is linked to the report. This issue has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should manually filter HTML output.

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.