CVE-2025-24367
Cacti allows Arbitrary File Creation leading to RCE
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cacti allows Arbitrary File Creation leading to RCE
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Record
CVE-2025-24367- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-144
- Updated
- 2026-11-02
EUVDEUVD-2025-3681
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Record
EUVD-2025-3681- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Record
CVE-2025-24367- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-144
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-24367
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Record
ALPINE-CVE-2025-24367- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Cacti allows Arbitrary File Creation leading to RCE
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Record
CVE-2025-24367- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-144
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-24367
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Record
DEBIAN-CVE-2025-24367- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-24367
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
- Record
UBUNTU-CVE-2025-24367- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cactiAlpine:v3.21 |
before 1.2.29-r0 | 1.2.29-r0 |
cactiAlpine:v3.22 |
before 1.2.29-r0 | 1.2.29-r0 |
cactiAlpine:v3.23 |
before 1.2.29-r0 | 1.2.29-r0 |
cactiAlpine:v3.24 |
before 1.2.29-r0 | 1.2.29-r0 |
cactiDebian:12 |
before 1.2.24+ds1-1+deb12u5, plus listed versions 1.2.24+ds1-11.2.24+ds1-1+deb12u11.2.24+ds1-1+deb12u21.2.24+ds1-1+deb12u31.2.24+ds1-1+deb12u4 |
1.2.24+ds1-1+deb12u5 |
cactiDebian:13 |
before 1.2.28+ds1-4 | 1.2.28+ds1-4 |
cactiDebian:14 |
before 1.2.28+ds1-4 | 1.2.28+ds1-4 |
cactiDebian:11 |
before 1.2.16+ds1-2+deb11u5, plus listed versions 1.2.16+ds1-21.2.16+ds1-2+deb11u11.2.16+ds1-2+deb11u21.2.16+ds1-2+deb11u31.2.16+ds1-2+deb11u4 |
1.2.16+ds1-2+deb11u5 |
cactiUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.10.8.8b+dfsg-5ubuntu0.20.8.8b+dfsg-5ubuntu0.2+esm10.8.8b+dfsg-5ubuntu0.2+esm2 |
None known |
cactiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.8.8f+ds1-20.8.8f+ds1-30.8.8f+ds1-40.8.8f+ds1-4ubuntu10.8.8f+ds1-4ubuntu2 Show 7 moreShow less0.8.8f+ds1-4ubuntu30.8.8f+ds1-4ubuntu40.8.8f+ds1-4ubuntu4.16.040.8.8f+ds1-4ubuntu4.16.04.10.8.8f+ds1-4ubuntu4.16.04.20.8.8f+ds1-4ubuntu4.16.04.2+esm10.8.8f+ds1-4ubuntu4.16.04.2+esm2 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cactiUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.18+ds1-11.1.27+ds1-21.1.27+ds1-31.1.28+ds1-21.1.35+ds1-1 Show 5 moreShow less1.1.36+ds1-11.1.38+ds1-11.1.38+ds1-1ubuntu0.1~esm11.1.38+ds1-1ubuntu0.1~esm31.1.38+ds1-1ubuntu0.1~esm4 |
None known |
cactiUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.2.4+ds1-2ubuntu31.2.9+ds1-1ubuntu11.2.9+ds1-1ubuntu21.2.10+ds1-1ubuntu11.2.10+ds1-1ubuntu1+esm11.2.10+ds1-1ubuntu1.11.2.10+ds1-1ubuntu1.1+esm11.2.10+ds1-1ubuntu1.1+esm2 |
None known |
cactiUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.2.16+ds1-2ubuntu11.2.19+ds1-2ubuntu11.2.19+ds1-2ubuntu1+esm11.2.19+ds1-2ubuntu1.11.2.19+ds1-2ubuntu1.1+esm11.2.19+ds1-2ubuntu1.1+esm2 |
None known |
cactiUbuntu:24.04:LTS |
All versions, plus listed versions 1.2.25+ds1-21.2.26+ds1-11.2.26+ds1-1ubuntu0.1 |
None known |
cactiUbuntu:25.10 |
All versions, plus listed versions 1.2.28+ds1-4ubuntu11.2.30+ds1-1ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Cacti Graph Template authenticated RCE versions prior to 1.2.29 | 2025-01-27 |
| PoC in GitHub | TheCyberGeek/CVE-2025-24367-Cacti-PoC | 2025-10-30 |
| PoC in GitHub | r3vpwnx/CVE-2025-24367 | 2025-12-12 |
| PoC in GitHub | SoftAndoWetto/CVE-2025-24367-PoC-Cacti | 2025-12-14 |
| PoC in GitHub | matesz44/CVE-2025-24367 | 2026-01-15 |
| PoC in GitHub | ShoshinMaster/CVE-2025-24367 | 2026-01-19 |
| PoC in GitHub | dantedansh/CVE-2025-24367-Cacti-Exploit | 2026-05-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, exploits, references | OSV | |
| first indexed | CVE List, EUVD, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-24367 is a high vulnerability (CVSS 8.7) in Cacti, published January 27, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 58.8%, the 99th percentile. Fixed in cacti 1.2.29-r0.
References
github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq
lists.debian.org/debian-lts-announce/2025/02/msg00010.html
security.alpinelinux.org/vuln/CVE-2025-24367
nvd.nist.gov/vuln/detail/CVE-2025-24367
security-tracker.debian.org/tracker/CVE-2025-24367
ubuntu.com/security/CVE-2025-24367
cve.org/CVERecord?id=CVE-2025-24367