CVE-2024-25642- Arbitrary File Write Vulnerability

[Htet]

Could someone please kindly advise how to harden cacti 1.2.24 for below mention Vulnerability?

CVE-2024-25642- Arbitrary File Write Vulnerability
1. Successful exploitation of this vulnerability could allow an authenticated attacker, with "Import Templates"
2. This vulnerability affects all Cacti versions prior to the latest (<=1.2.26)

Best Regards,
Htet Htet

[macan]

Template can contain more files which are saved to /your/cacti/resource directory. In malicious template can be different path and file (php, shell script) could be saved to another location.

We recommned update to 1.2.27