Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cacti | Aug 22, 2024 | May 13, 2024 |
| Debian | — | Upgrade cacti | Sep 2, 2024 | May 14, 2024 |
| Suse | — | Upgrade cactiUpgrade cacti-spine | Dec 5, 2025 | Sep 2, 2024 |
| Ubuntu | — | Upgrade cacti (Ubuntu Pro)Upgrade cacti | Aug 21, 2024 | May 14, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub