CVE-2024-29895
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on…
Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
- Vendor
- Unknown
- Product
- Unknown
- CVSS 3.1
- 10 (critical), scored by security-advisories@github.comCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CWE
- CWE-77
- Published
- 2024-05-14
- NVD modified
- 2026-06-17
- NVD status
- Deferred
Not in the CISA KEV catalogue at the last update.
EPSS
98.5% chance of exploitation in the next 30 days (percentile 99th)
FIRST EPSS, updated 17 Oct 2026. About EPSS
CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.
References
Data last updated 18 Oct 2026. Sources: NVD API 2.0, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.