DEBIAN-CVE-2025-24367

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.

References

https://security-tracker.debian.org/tracker/CVE-2025-24367

Affected packages

Debian:12 / cacti

Package

Name: cacti
Purl: pkg:deb/debian/cacti?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.2.24+ds1-1+deb12u5

Affected versions

1.*

1.2.24+ds1-1

1.2.24+ds1-1+deb12u1

1.2.24+ds1-1+deb12u2

1.2.24+ds1-1+deb12u3

1.2.24+ds1-1+deb12u4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-24367.json"

Debian:13 / cacti

Package

Name: cacti
Purl: pkg:deb/debian/cacti?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.2.28+ds1-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-24367.json"

Debian:14 / cacti

Package

Name: cacti
Purl: pkg:deb/debian/cacti?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.2.28+ds1-4

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-24367.json"