CVE-2023-49084 - CVE House
Back to Database
Status published High CVE-2023-49084

Local File Inclusion (RCE) in Cacti

Vulnerability Description

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `link.php`. Impact of the vulnerability execution of arbitrary code on the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-49084

Credits & Attribution

No credits recorded in the NVD database.

References

More from Cacti

View All →
CVE-2025-66399
SNMP Command Injection leads to RCE in Cacti
High 7.4
CVE-2025-26520
Cacti through 1.2.29 allows SQL injection in the template function...
High 7.6
CVE-2025-24368
Cacti has a SQL Injection vulnerability when using tree rules through Automation API
Medium 6.9
CVE-2025-24367
Cacti allows Arbitrary File Creation leading to RCE
High 8.7
CVE-2025-22604
Cacti has Authenticated RCE via multi-line SNMP responses
Critical 9.1

Affected Vendor

Affected Software

cacti
Vulnerable Versions:
= 1.2.25

Timeline

Official Publish: December 21st, 2023
Last Modified: February 25th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-98

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505 Server Software Component
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1005 Data from Local System
Collection