| Name | CVE-2025-45160 |
| Description | A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application reflects the submitted filename back into an error popup without proper sanitization. As a result, attackers can inject arbitrary HTML elements (e.g., <h1>, <b>, <svg>) into the rendered page. NOTE: Multiple third-parties including the maintainer have stated that they cannot reproduce this issue after 1.2.27. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| cacti (PTS) | bullseye | 1.2.16+ds1-2+deb11u3 | vulnerable |
| bullseye (security) | 1.2.16+ds1-2+deb11u5 | vulnerable |
| bookworm, bookworm (security) | 1.2.24+ds1-1+deb12u5 | fixed |
| forky, sid, trixie | 1.2.30+ds1-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| cacti | source | bookworm | 1.2.24+ds1-1+deb12u3 | | | |
| cacti | source | (unstable) | 1.2.27+ds1-1 | | | |
Notes
[bullseye] - cacti <postponed> (Minor issue, reflected XSS, no JavaScript)
https://gist.github.com/BEND0US/49d76897a5bb676d8c3f51425553cc32
Upstream confirmed it is covered/fixed with same fixes for CVE-2023-50250 and
the followup CVE-2024-29894. Consider it as fixed with the update including
both updates.