CVE-2025-26520 is a High severity SQL injection flaw (CVSS 7.6) in Cacti through version 1.2.29. It is in the template function of host_templates.php, through the graph_template parameter, and exists because an earlier fix for CVE-2024-54146 was incomplete. The record names no fixed release, so check upstream.
What's affected
- Product: Cacti, the open source network monitoring and graphing tool
- Affected: through 1.2.29 per the record
- File: host_templates.php, in the template function
- Parameter: graph_template
- Fixed: the record names no release. A code change is linked from the record
The record explains where this came from: the issue exists because of an incomplete fix for CVE-2024-54146. That earlier flaw was an SQL injection when viewing a host template. The 1.2.29 change log lists that item as fixed, so a system on 1.2.29 may believe it is patched when it is not.
The code change linked in the record replaces a raw request value with a filtered one in the line that builds the where clause for the graph template filter. I did not find this CVE named in the project change log pages I read, so I cannot name the first release that contains the fix. Read the Cacti release notes or security advisories for the exact version before you upgrade.
How to check if you're exposed
Find your Cacti version. It is shown in the web console footer and in the console under the system utilities. On the host you can also check the package manager if you installed it that way:
dpkg -l | grep -i cacti # Debian and Ubuntu
rpm -qa | grep -i cacti # RHEL and derivatives
For a source install, compare the code in host_templates.php with the change linked in the record. If your copy uses the raw request value in the graph template filter, it has not received the fix.
The CVSS vector for this flaw shows that low privileges are required, so the people most at risk are users who can log in. Review who has accounts and whether the console is reachable from the internet.
What to do now
- Find every Cacti server and its version.
- Read the Cacti project's release notes and security advisories, and upgrade to the first release that includes the fix for this issue. If you cannot confirm one, apply the upstream code change to host_templates.php.
- Limit access to the Cacti console to the networks that need it, and remove unused accounts.
- Review the database account that Cacti uses, so that it has only the permissions it needs.
- Check web server logs for unusual values sent to host_templates.php in the graph_template parameter.
Why it matters
The weakness is CWE-89 (SQL injection). The code built a database filter from a request value without making sure it was a plain number. The fix, as linked in the record, runs the value through a filter function that checks it first.
The lesson is about incomplete fixes. When a project fixes an injection flaw on one page, the same pattern often lives on another line or another page. CVE-2024-54146 was fixed, and this issue arrived because a sibling line was left unchanged. When you patch, check release notes for the specific CVE you are chasing, not only the version number.
Monitoring tools hold a map of your network and often the credentials used to poll it, so they are worth defending. The record does not claim that the issue is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is Cacti 1.2.29 safe from CVE-2025-26520?
No. The record says Cacti through 1.2.29 is affected, because the earlier fix for CVE-2024-54146 was incomplete.
Which version fixes CVE-2025-26520?
I could not confirm a fixed release from the pages I read. The record links a code change, so check the Cacti release notes and advisories for the version that includes it.
Sources
Check your own dependencies with the free in-browser scan.
Last reviewed: 19 October 2026.
