CVE-2024-25641: Cacti Package Import arbitrary file write leading to PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw yields code execution on a monitoring server, has a very high EPSS score and public exploit references, though it requires an authenticated privileged account.

What it is

Cacti before 1.2.27 trusts filenames and content in XML data handled by the import_package() function in /lib/import.php, allowing arbitrary file writes into the Cacti base path or outside it via path traversal. An authenticated user with the Import Templates permission can write or overwrite files and execute arbitrary PHP code on the web server. The flaw is fixed in version 1.2.27.

Impact

An attacker with the Import Templates permission gains arbitrary file write on the web server, which can be turned into remote code execution as the web server user and potentially full compromise of the Cacti host.

Attack surface

Reached over the network through the Package Import feature of the Cacti web interface; it requires an authenticated account holding the Import Templates permission and no user interaction beyond submitting the import.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.863, 99.7th percentile) and the vendor advisory is tagged Exploit, indicating public exploit material exists. No ransomware usage is documented.

What to do

• Upgrade Cacti to 1.2.27 or later, and apply the corresponding Fedora/Debian package updates where Cacti is packaged.
• Restrict the Import Templates permission to the smallest possible set of trusted administrators.
• Run the Cacti web service with a low-privilege account and confine its filesystem write access to required directories.
• Monitor and alert on unexpected file creation or modification under the Cacti base path, especially PHP files.
• Where feasible, block or tightly control access to the package import functionality from untrusted networks.

Detection

• Audit Cacti user accounts and permission assignments for unexpected holders of the Import Templates permission.
• Monitor the Cacti base path and web root for newly created or modified PHP files and for path traversal sequences in import activity.
• Review web server and Cacti logs for package import requests followed by execution of newly written files.
• Alert on outbound or process activity from the web server user consistent with webshell execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.