A Path Traversal flaw exists in the filename parameter of Cacti's package_import.php. The vulnerability allows an attacker to override the intended file path and access arbitrary files on the server, potentially exposing sensitive configuration data or executing malicious code. The weakness corresponds to CWE-22, which focuses on improper validation of user-supplied input for file system access.

The flaw affects all Cacti installations running version 1.2.30 and earlier. The vendor has released version 1.2.31, in which the issue has been addressed; users should verify that their instance matches or exceeds this version.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. Attackers would likely need access to the web interface that hosts package_import.php, and the path traversal may require some level of authentication or prior knowledge of the vulnerable parameter. The exact exploitation steps are not detailed in the advisory, but an attacker could manipulate the filename parameter to read or write files outside the intended directory.