CVE-2024-25641: Cacti RCE vulnerability when importing packages

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 86.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-20

Description

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.

Affected products

cacti: before 1.2.27 — fixed in 1.2.27
Fedoraproject Fedora: 39

How to fix

Upgrade to a fixed version: cacti 1.2.27. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-25641 or the next vulnerability affects your stack