CVE-2024-27082: Cacti Cross-site Scripting vulnerability when managing trees

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-79

Description

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site scripting, a type of cross-site scripting where malicious scripts are permanently stored on a target server and served to users who access a particular page. Version 1.2.27 contains a patch for the issue.

Affected products

cacti: before 1.2.27 — fixed in 1.2.27

How to fix

Upgrade to a fixed version: cacti 1.2.27. Check the vendor advisory for mitigations.

References

https://github.com/Cacti/cacti/security/advisories/GHSA-j868-7vjp-rp9h
https://github.com/Cacti/cacti/security/advisories/GHSA-j868-7vjp-rp9h

Get alerted when CVE-2024-27082 or the next vulnerability affects your stack