CVE-2025-45160: 
Cacti vulnerability analysis and mitigation

CVE-2025-45160 is an HTML injection vulnerability in the file upload functionality of Cacti, an open-source network monitoring and graphing platform. Affecting Cacti versions <= 1.2.29, the flaw allows authenticated attackers to inject arbitrary HTML elements into error popups by uploading a file with an invalid format and a crafted filename. The vulnerability was disclosed on January 29, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat Bugzilla, Feedly). Notably, multiple third parties including the Cacti maintainer have stated they cannot reproduce the issue in versions beyond 1.2.27, after DOMPurify was introduced (GitHub Gist).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-80, CWE-79), where the application reflects the submitted filename unsanitized into an error popup rendered in the browser. The vulnerable endpoint is POST /templates_import.php?preview_only=true, and the vulnerable parameter is filename. An attacker uploads a file with invalid XML content and a crafted filename (e.g., <h1>HACK</h1>.xml), triggering an XML parsing error that causes the application to display the unsanitized filename in a popup. The researcher who discovered the issue (Dogus Demirkiran) clarified that this is not a JavaScript XSS issue — DOMPurify prevents script execution — but rather a structural HTML injection affecting DOM layout and potentially enabling UI redressing or social engineering (GitHub Gist).

Successful exploitation allows an authenticated attacker to inject arbitrary HTML elements (e.g., <h1>, <b>, <svg>) into the Cacti web interface, altering the DOM layout and potentially misleading users through UI redressing or social engineering attacks. Because DOMPurify is present in versions after 1.2.27, JavaScript execution (XSS) is not achievable, limiting the impact to confidentiality and integrity at a low level. The vulnerability does not affect availability and requires low-privilege authenticated access to exploit (GitHub Gist, Red Hat Bugzilla).

No public proof-of-concept exploit code beyond the researcher's disclosure gist exists, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.028% (very low), reflecting minimal likelihood of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access (low privileges), limiting the attacker pool to users with valid Cacti credentials (Feedly, GitHub Gist).

1. Authentication: Log in to the Cacti web interface with any valid low-privilege user account.
2. Navigate to the upload endpoint: Go to the Template Import page, which accepts XML template files via POST /templates_import.php?preview_only=true.
3. Craft a malicious filename: Prepare a file with invalid XML content (content may be empty or malformed) and rename it to a filename containing HTML tags, e.g., <h1>Injected</h1>.xml.
4. Upload the file: Submit the file via the template import form. The invalid XML triggers a parsing error.
5. Observe injection: The application reflects the unsanitized filename in the error popup, rendering the injected HTML elements (e.g., a large heading) in the browser DOM, which can be used for UI redressing or social engineering against other users viewing the same session or shared interface (GitHub Gist).

• Network: Unusual POST requests to /templates_import.php?preview_only=true containing HTML tags (e.g., <h1>, <svg>, <b>) within the filename parameter.
• Logs: Web server access logs showing POST requests to templates_import.php with encoded or raw HTML characters (%3Ch1%3E, <h1>) in the request body or filename field.
• Application Behavior: Error popups in the Cacti UI displaying unexpected HTML formatting or altered layout elements following a file upload attempt.

Upgrade Cacti to a version beyond 1.2.29; the latest stable release is v1.2.30 (released March 23, 2025), which is available on the Cacti GitHub repository. As a workaround, implement strict server-side validation and sanitization of uploaded filenames before reflecting them in error messages, and apply a Web Application Firewall (WAF) rule to block HTML tags in file upload parameters. Restricting template import functionality to administrator-level users only reduces the attack surface (Red Hat Bugzilla, Cacti GitHub).

The Cacti maintainer and CERT Orange Cyberdefense (user z00z00z00) both commented on the researcher's disclosure gist, stating they could not reproduce the issue on Cacti versions 1.2.27 and later due to the introduction of DOMPurify. The researcher (Dogus Demirkiran / BEND0US) acknowledged the low severity but maintained the HTML injection is reproducible via the filename handling path, distinct from DOMPurify's rendering sanitization. The CVE description itself includes a note that multiple third parties cannot reproduce the issue after 1.2.27, reflecting community skepticism about the scope of affected versions (GitHub Gist).