CVE-2025-45160: Medium severity Cacti Cacti vulnerability
A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application reflects the submitted filename back into an error popup without proper sanitization. As a result, attackers can inject arbitrary HTML elements (e.g., <h1>, <b>, <svg>) into the rendered page. NOTE: Multiple third-parties including the maintainer have stated that they cannot reproduce this issue after 1.2.27.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-45160?
The severity of CVE-2025-45160 is considered moderate due to the potential for HTML injection.
How do I fix CVE-2025-45160?
To fix CVE-2025-45160, upgrade to Cacti version 1.2.30 or later where the vulnerability is patched.
What impact does CVE-2025-45160 have on my system?
CVE-2025-45160 allows attackers to inject arbitrary HTML, which could lead to cross-site scripting (XSS) and other security risks.
Which versions of Cacti are affected by CVE-2025-45160?
CVE-2025-45160 affects Cacti versions up to and including 1.2.29.
How does CVE-2025-45160 work?
CVE-2025-45160 works by allowing an attacker to upload files with invalid formats, leading to unsanitized reflection of filenames in error messages.