cacti: A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29
CVE-2025-45160 is fixed in cacti on 1 platform, first by DEBIAN-CVE-2025-45160, released January 29, 2026. It is not reported as exploited. Patch Radar priority: Routine.
A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application reflects the submitted filename back into an error popup without proper sanitization. As a result, attackers can inject arbitrary HTML elements (e.g., <h1>, <b>, <svg>) into the rendered page. NOTE: Multiple third-parties including the maintainer have stated that they cannot reproduce this issue after 1.2.27.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| cacti · Debian 12.15 (bookworm) | 1.2.24+ds1-1+deb12u3 | DEBIAN-CVE-2025-45160 | Jan 29, 2026 |
| cacti · Debian 13.5 (trixie) | 1.2.27+ds1-1 | DEBIAN-CVE-2025-45160 | Jan 29, 2026 |
| cacti · Debian 14 | 1.2.27+ds1-1 | DEBIAN-CVE-2025-45160 | Jan 29, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.