SQL Injection Vulnerability in Cacti by Cacti Group
CVE-2025-26520

9.8CRITICAL

Key Information:

Vendor

Cacti

Status
Cacti
Vendor
CVE Published:
12 February 2025

What is CVE-2025-26520?

Cacti version 1.2.29 is susceptible to an SQL injection vulnerability through the template function in host_templates.php. The vulnerability is triggered via the graph_template parameter, potentially allowing an attacker to execute malicious SQL queries against the database. This issue arises from an incomplete fix of a prior vulnerability, underlining the importance of proper patch management and security practices in web applications.

Affected Version(s)

Cacti 0 <= 1.2.29

References

https://github.com/Cacti/cacti/pull/6096
https://github.com/Cacti/cacti/commit/7fa60c03ad4a69c701a...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-26520 : SQL Injection Vulnerability in Cacti by Cacti Group