CVE-2025-24367

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Cacti, an open source performance and fault management framework, contains a vulnerability that allows an authenticated user to abuse graph creation and graph template functionality. By exploiting flaws tracked under CWE-144, the attacker can write arbitrary PHP scripts into the application's web root directory, resulting in remote code execution on the server. The issue affects versions prior to the 1.2.29 release published on 27 January 2025 and carries a CVSS 4.0 score of 8.7.

An authenticated Cacti user with graph management privileges can supply crafted input during graph or template operations to place executable PHP files on the server. Once written, these scripts can be invoked over the network to execute arbitrary commands with the privileges of the web server process, giving the attacker full control over the underlying host without requiring additional authentication or user interaction.

The official fix is included in Cacti 1.2.29, as referenced in the project's GitHub commit and the accompanying GitHub Security Advisory GHSA-fxrq-fr7h-9rqq. Downstream distributions such as Debian have issued corresponding updates through their long-term support channels to backport the correction.

The CVE maintains a high EPSS score with a current value of 0.8793 and a recorded peak of 0.9056, indicating sustained exploitation interest following disclosure.