CVE-2025-24367: Cacti graph/template feature allows authenticated PHP file write and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityAuthenticated remote code execution with a high EPSS score and public exploit detail, though it requires a valid account and is not in KEV.

What it is

Cacti lets an authenticated user abuse graph creation and graph template functionality to write arbitrary PHP scripts into the application web root. Because the written files are executable PHP in a web-accessible directory, this turns a low-privilege authenticated account into server-side code execution. The flaw is fixed in Cacti 1.2.29.

Impact

An attacker with a valid Cacti account gains remote code execution on the server, allowing full compromise of the Cacti host and any data or credentials it can reach.

Attack surface

Reached over the network through the Cacti web interface; the CVSS 4.0 vector shows network attack, low complexity, and low privileges required, with no user interaction. Authentication is required, so the attacker needs at least one valid Cacti account.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.54024, ~98.95th percentile) and the vendor advisory is tagged Exploit, indicating public exploit detail exists. No ransomware group use is documented.

What to do

• Upgrade Cacti to 1.2.29 or later, which contains the fix.
• Restrict and audit Cacti accounts; remove or disable unused accounts and avoid granting graph/template editing rights broadly.
• Ensure the Cacti web root is not writable by the web server process where feasible, and monitor for unexpected PHP files there.
• Apply the Debian LTS update if running the packaged version on Debian.
• Place Cacti behind authentication and network restrictions so it is not exposed to untrusted networks.

Detection

• Monitor the Cacti web root for newly created or modified .php files and alert on unexpected writes.
• Review web server logs for requests to Cacti graph/template endpoints followed by access to newly created PHP files.
• Audit Cacti user activity and logs for graph or graph template creation by accounts that do not normally use those features.
• Watch for outbound connections or child processes spawned by the web server that indicate code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.