{"id":"CVE-2023-49084","aliases":["ALPINE-CVE-2023-49084","DEBIAN-CVE-2023-49084","DLA-3765-1","DSA-5646-1","EUVD-2023-53099","GHSA-pfh9-gwm6-86vp","UBUNTU-CVE-2023-49084","openSUSE-SU-2024:0031-1","openSUSE-SU-2024:13533-1"],"status":"published","title":"Local File Inclusion (RCE) in Cacti","description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.64448,"percentile":0.99244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-98"],"published":"2023-12-21T23:04:44Z","modified":"2026-11-03T06:32:43Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/cacti_pollers_sqli_rce","title":"Cacti RCE via SQLi in pollers.php","type":"exploit","platform":"Linux,Unix,Windows","date":"2023-12-20","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/cacti_pollers_sqli_rce"}],"fixes":[{"ecosystem":"Alpine:v3.18","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cacti","fixed_in":["1.2.26-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cacti","fixed_in":["1.2.24+ds1-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cacti","fixed_in":["1.2.26+ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cacti","fixed_in":["1.2.26+ds1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24+ds1-1+deb12u2"}]}],"versions":["1.2.24+ds1-1","1.2.24+ds1-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26+ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2+ds1-2+deb10u6"}]}],"versions":["1.2.2+ds1-2","1.2.2+ds1-2+deb10u1","1.2.2+ds1-2+deb10u2","1.2.2+ds1-2+deb10u3","1.2.2+ds1-2+deb10u4","1.2.2+ds1-2+deb10u5"],"bundled":13},{"source":"osv","ecosystem":"Debian:11","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.16+ds1-2+deb11u3"}]}],"versions":["1.2.16+ds1-2","1.2.16+ds1-2+deb11u1","1.2.16+ds1-2+deb11u2"],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24+ds1-1+deb12u2"}]}],"versions":["1.2.24+ds1-1","1.2.24+ds1-1+deb12u1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8b+dfsg-3","0.8.8b+dfsg-5","0.8.8b+dfsg-5ubuntu0.1","0.8.8b+dfsg-5ubuntu0.2","0.8.8b+dfsg-5ubuntu0.2+esm1","0.8.8b+dfsg-5ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.8f+ds1-2","0.8.8f+ds1-3","0.8.8f+ds1-4","0.8.8f+ds1-4ubuntu1","0.8.8f+ds1-4ubuntu2","0.8.8f+ds1-4ubuntu3","0.8.8f+ds1-4ubuntu4","0.8.8f+ds1-4ubuntu4.16.04","0.8.8f+ds1-4ubuntu4.16.04.1","0.8.8f+ds1-4ubuntu4.16.04.2","0.8.8f+ds1-4ubuntu4.16.04.2+esm1","0.8.8f+ds1-4ubuntu4.16.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.18+ds1-1","1.1.27+ds1-2","1.1.27+ds1-3","1.1.28+ds1-2","1.1.35+ds1-1","1.1.36+ds1-1","1.1.38+ds1-1","1.1.38+ds1-1ubuntu0.1~esm1","1.1.38+ds1-1ubuntu0.1~esm3","1.1.38+ds1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4+ds1-2ubuntu3","1.2.9+ds1-1ubuntu1","1.2.9+ds1-1ubuntu2","1.2.10+ds1-1ubuntu1","1.2.10+ds1-1ubuntu1+esm1","1.2.10+ds1-1ubuntu1.1","1.2.10+ds1-1ubuntu1.1+esm1","1.2.10+ds1-1ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.16+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1+esm1","1.2.19+ds1-2ubuntu1.1","1.2.19+ds1-2ubuntu1.1+esm1","1.2.19+ds1-2ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"cacti-spine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-bp155.2.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.26-1.1"}]}],"bundled":6}],"products":[{"vendor":"cacti","product":"cacti"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","report"]},{"url":"http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/","tags":["x_transferred","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-49084","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49084.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49084","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49084","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49084","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IZJKJNYP7JFJ3XMRIGZT22J5DIAVPSY7/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218360","tags":["report"]},{"url":"https://bugzilla.suse.com/1218366","tags":["report"]},{"url":"https://bugzilla.suse.com/1218378","tags":["report"]},{"url":"https://bugzilla.suse.com/1218379","tags":["report"]},{"url":"https://bugzilla.suse.com/1218380","tags":["report"]},{"url":"https://bugzilla.suse.com/1218381","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51448","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-49084","title":"Local File Inclusion (RCE) in Cacti","description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","status":"published","published":"2023-12-21T23:04:44.219Z","modified":"2026-02-25T16:34:32.758Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:35:13.368958Z"}],"euvd":[{"id":"EUVD-2023-53099","description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","status":"published","published":"2023-12-21T23:04:44Z","modified":"2026-02-25T16:34:32Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:29.128374Z"}],"nvd":[{"id":"CVE-2023-49084","description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","status":"published","published":"2023-12-21T23:15:09.337Z","modified":"2026-06-17T06:35:19.95Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"ALPINE-CVE-2023-49084","description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","status":"published","published":"2023-12-21T23:15:09.337Z","modified":"2026-11-03T06:32:43.76858116Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2023-49084","title":"Local File Inclusion (RCE) in Cacti","description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","status":"published","published":"2023-12-21T23:04:44.219Z","modified":"2026-10-28T02:30:28.946494357Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-49084","description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","status":"published","published":"2023-12-21T23:15:09.337Z","modified":"2026-10-26T18:02:49.901065051Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-49084","description":"Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.","status":"published","published":"2023-12-21T23:15:00Z","modified":"2025-10-24T05:02:21Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"DLA-3765-1","title":"cacti - security update","status":"published","published":"2024-03-18T00:00:00Z","modified":"2026-03-09T01:19:04.16814Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5646-1","title":"cacti - security update","status":"published","published":"2024-03-24T00:00:00Z","modified":"2026-03-09T02:10:33.052825Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:0031-1","title":"Security update for cacti, cacti-spine","description":"This update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine 1.2.26:\n\n* Fix: Errors when uptime OID is not present\n* Fix: MySQL reconnect option is depreciated\n* Fix: Spine does not check a host with no poller items\n* Fix: Poller may report the wrong number of devices polled\n* Feature: Allow users to override the threads setting at the command line\n* Feature: Allow spine to run in ping-only mode\n\ncacti 1.2.26:\n\n* CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380)\n* CVE-2023-49084: RCE vulnerability when managing links (boo#1218360)\n* CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378)\n* CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366)\n* CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379)\n* CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381)\n* When viewing data sources, an undefined variable error may be seen\n* Improvements for Poller Last Run Date\n* Attempting to edit a Data Query that does not exist throws warnings and not an GUI error\n* Improve PHP 8.1 support when adding devices\n* Viewing Data Query Cache can cause errors to be logged\n* Preserve option is not properly honoured when removing devices at command line\n* Infinite recursion is possible during a database failure\n* Monitoring Host CPU's does not always work on Windows endpoints\n* Multi select drop down list box not rendered correctly in Chrome and Edge\n* Selective Plugin Debugging may not always work as intended\n* During upgrades, Plugins may be falsely reported as incompatible\n* Plugin management at command line does not work with multiple plugins\n* Improve PHP 8.1 support for incrementing only numbers\n* Allow the renaming of guest and template accounts\n* DS Stats issues warnings when the RRDfile has not been initialized\n* When upgrading, missing data source profile can cause errors to be logged\n* When deleting a single Data Source, purge historical debug data\n* Improvements to form element warnings\n* Some interface aliases do not appear correctly\n* Aggregate graph does not show other percentiles\n* Settings table updates for large values reverted by database repair\n* When obtaining graph records, error messages may be recorded\n* Unable to change a device's community at command line\n* Increase timeout for RRDChecker\n* When viewing a graph, option to edit template may lead to incorrect URL\n* When upgrading, failures may occur due to missing color table keys\n* On installation, allow a more appropriate template to be used as the default\n* When data input parameters are allowed to be null, allow null\n* CSV Exports may not always output data correctly\n* When debugging a graph, long CDEF's can cause undesirable scrolling\n* Secondary LDAP server not evaluated when the first one has failed\n* When adding a device, using the bulk walk option can make version information appear\n* When parsing a Data Query resource, an error can be reported if no direction is specified\n* Database reconnection can cause errors to be reported incorrectly\n* fix returned value if $sau is empty\n* Add Aruba switch, Aruba controller and HPE iLO templates\n* Add OSCX 6x00 templates\n","status":"published","published":"2024-01-24T12:47:05Z","modified":"2026-02-04T02:28:19.679293Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:13533-1","title":"cacti-1.2.26-1.1 on GA media","description":"These are all security issues fixed in the cacti-1.2.26-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:52.465734Z","updated_at":"2026-11-02T16:58:36.327643Z"}]}}