CVE-2005-1526

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows...

7.5 HighPublic exploitFix available

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.

Exploit likelihood

16.6%Up 4.0 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.

Record: CVE-2005-1526
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.

Record: CVE-2005-1526
Updated: 2026-11-02

EUVDEUVD-2005-1529 No score

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.

Record: EUVD-2005-1529
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jm3f-754c-hx48 No score

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows...

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.

Record: GHSA-jm3f-754c-hx48
Updated: 2026-11-02

OSV No score

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.

Record: CVE-2005-1526
Updated: 2026-11-02

OSVDEBIAN-CVE-2005-1526 No score

PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.

Record: DEBIAN-CVE-2005-1526
Updated: 2026-11-02

Affected products

the cacti group cacti

Affected packages

Affected packages
Package	Affected	Fixed
`cacti` Debian:12	before 0.8.6e-1	0.8.6e-1
`cacti` Debian:13	before 0.8.6e-1	0.8.6e-1
`cacti` Debian:14	before 0.8.6e-1	0.8.6e-1
`cacti` Debian:3.0 From an advisory covering 5 CVEs	before 0.6.7-2.5, plus listed versions 0.6.7-20.6.7-2.10.6.7-2.20.6.7-2.30.6.7-2.4	0.6.7-2.5
`cacti` Debian:3.1 From an advisory covering 5 CVEs	before 0.8.6c-7sarge2, plus listed versions 0.8.6c-7	0.8.6c-7sarge2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	RaXnet Cacti 0.5/0.6/0.8 - 'Config_Settings.php' Remote File Inclusion	2005-06-20

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-1526 is a high vulnerability (CVSS 7.5) in The Cacti Group Cacti, published June 22, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 16.6%, the 97th percentile. Fixed in cacti 0.8.6e-1.

References

Show 8 moreShow less