{"id":"CVE-2024-25641","published":"2024-05-13T13:28:58Z","modified":"2025-11-04T16:11:23Z","title":"Cacti RCE vulnerability when importing packages","vendor":"Cacti","product":"cacti","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cacti","product":"cacti","versions":["< 1.2.27"]}],"description":{"text":"Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the \"Package Import\" feature, allows authenticated users having the \"Import Templates\" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Cacti monitoring framework (product \"cacti\") contains an arbitrary file write flaw in the import_package() function of its /lib/import.php script, which is reached through the \"Package Import\" feature and trusts filenames and file content supplied in XML data without validation. An attacker who is authenticated and holds the \"Import Templates\" permission can exploit it over the network, without user interaction, to write or overwrite files on the web server, including PHP files that lead to arbitrary code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:04Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.86303,"percentile":0.99733,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Cacti/cacti/commit/eff35b0ff26cc27c82d7880469ed6d5e3bef6210","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/","tags":[]},{"url":"http://seclists.org/fulldisclosure/2024/May/6","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00027.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-22957","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22957","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52225,"url":"https://www.exploit-db.com/exploits/52225","title":"Cacti 1.2.26 -  Remote Code Execution (RCE) (Authenticated)","type":"webapps","platform":"php","date":"2025-04-15","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-04-15"},"pocGithub":{"count":7,"skipped":0,"earliest":"2024-08-26","earliestUrl":"https://github.com/5ma1l/CVE-2024-25641","repos":[{"name":"leo-mitch/CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26","url":"https://github.com/leo-mitch/CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26","stars":10,"created":"2024-08-27"},{"name":"5ma1l/CVE-2024-25641","url":"https://github.com/5ma1l/CVE-2024-25641","stars":8,"created":"2024-08-26"},{"name":"StopThatTalace/CVE-2024-25641-CACTI-RCE-1.2.26","url":"https://github.com/StopThatTalace/CVE-2024-25641-CACTI-RCE-1.2.26","stars":7,"created":"2024-08-29"},{"name":"Safarchand/CVE-2024-25641","url":"https://github.com/Safarchand/CVE-2024-25641","stars":2,"created":"2024-08-27"},{"name":"D3Ext/CVE-2024-25641","url":"https://github.com/D3Ext/CVE-2024-25641","stars":1,"created":"2025-01-05"}]},"metasploit":[{"name":"Cacti Import Packages RCE","module":"exploit/multi/http/cacti_package_import_rce","type":"exploit","disclosureDate":"2024-05-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb"}],"first":{"date":"2024-05-12","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-05-12","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-08-26, Exploit-DB 2025-04-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_package_import_rce.rb","provenance":"source"},{"date":"2024-05-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-25641","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9973"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 7 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}