CVE-2025-24367

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

54.02% chance of exploitation in the next 30 days, 99th percentile

Published

2025-01-27

Updated

2025-11-03

Proof-of-concept exploits (6)

• Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq
• ShoshinMaster/CVE-2025-24367
• SoftAndoWetto/CVE-2025-24367-PoC-Cacti
• TheCyberGeek/CVE-2025-24367-Cacti-PoC
• dantedansh/CVE-2025-24367-Cacti-Exploit
• Kh4ngTh41/HTB-Season10-CVE-Resarch

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_graph_template_…

Vulhub environments (1)

• vulhub/vulhub/tree/master/cacti/CVE-2025-24367

References

• CVE Record
• NVD entry

Related

• CVE-2019-16405
• CVE-2020-5844
• CVE-2026-3888
• CVE-2026-4480
• CVE-2025-49132
• CVE-2025-24365