medium5.4
CVE-2025-45160
A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29.
Impact
A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application reflects the submitted filename back into an error popup without proper sanitization. As a result, attackers can inject arbitrary HTML elements (e.g., <h1>, <b>, <svg>) into the rendered page. NOTE: Multiple third-parties including the maintainer have stated that they cannot reproduce this issue after 1.2.27.
Affected products
| Product | Affected versions |
|---|---|
| Cacti | through 1.2.29. |
Versions were read from the advisory text. No structured product data has been published for this record yet.