CVE-2025-24367
Cacti allows Arbitrary File Creation leading to RCE
HIGH 8.7EPSS 54.0%
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Affected
- Cacti · cacti
- CVSS v4.0 GITHUB
- 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 54.02% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2025-01-27
- Updated
- 2025-11-03
Proof-of-concept exploits (5)
- Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq
- ShoshinMaster/CVE-2025-243670★ · 2026-01-19
- SoftAndoWetto/CVE-2025-24367-PoC-Cacti0★ · 2025-12-15
- TheCyberGeek/CVE-2025-24367-Cacti-PoC38★ · 2025-12-08
- dantedansh/CVE-2025-24367-Cacti-Exploit0★ · 2026-05-02