{"id":"CVE-2025-24367","published":"2025-01-27T17:12:40Z","modified":"2025-11-03T21:12:40Z","title":"Cacti allows Arbitrary File Creation leading to RCE","vendor":"Cacti","product":"cacti","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cacti","product":"cacti","versions":["<= 1.2.28"]}],"description":{"text":"Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.","provenance":"source","from":"CVE.org"},"summary":{"text":"The vulnerability is in the graph creation and graph template functionality of Cacti, an open source performance and fault management framework, and allows arbitrary file creation. An authenticated Cacti user with network access to the application can abuse that functionality to create arbitrary PHP scripts in the web root, leading to remote code execution on the server, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:58Z"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.54259,"percentile":0.99007,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-144","name":"Improper Neutralization of Line Delimiters"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-3681","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-3681","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":1,"earliest":"2025-10-30","earliestUrl":"https://github.com/TheCyberGeek/CVE-2025-24367-Cacti-PoC","repos":[{"name":"TheCyberGeek/CVE-2025-24367-Cacti-PoC","url":"https://github.com/TheCyberGeek/CVE-2025-24367-Cacti-PoC","stars":37,"created":"2025-10-30"},{"name":"matesz44/CVE-2025-24367","url":"https://github.com/matesz44/CVE-2025-24367","stars":1,"created":"2026-01-15"},{"name":"r3vpwnx/CVE-2025-24367","url":"https://github.com/r3vpwnx/CVE-2025-24367","stars":0,"created":"2025-12-12"},{"name":"SoftAndoWetto/CVE-2025-24367-PoC-Cacti","url":"https://github.com/SoftAndoWetto/CVE-2025-24367-PoC-Cacti","stars":0,"created":"2025-12-14"},{"name":"dantedansh/CVE-2025-24367-Cacti-Exploit","url":"https://github.com/dantedansh/CVE-2025-24367-Cacti-Exploit","stars":0,"created":"2026-05-02"}]},"metasploit":[{"name":"Cacti Graph Template authenticated RCE versions prior to 1.2.29","module":"exploit/multi/http/cacti_graph_template_rce","type":"exploit","disclosureDate":"2025-01-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_graph_template_rce.rb"}],"first":{"date":"2025-01-27","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_graph_template_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-01-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-24367","provenance":"source"},{"date":"2025-01-27","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-10-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cacti_graph_template_rce.rb","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":30.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.8,"detail":"percentile 0.9901"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.09,"detail":"base score 8.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}