Package: cacti Version: 1.2.31+ds1-1 Severity: normal Tags: patch As part of security fixes in 1.2.31 the realpath for script servers was limited to `base_path` (/usr/share/cacti/site/scripts/). Debian symlinks that to /var/lib/cacti/scripts so the security check fails.
Upstream has fixed this with commit 7015c26 (https://github.com/Cacti/cacti/pull/7320) which allows scripts to also reside in `scripts_path`. Please consider applying the fix (and adding script_path to the default debian config) as a patch. Thanks Norman -- System Information: Debian Release: forky/sid APT prefers testing APT policy: (700, 'testing'), (500, 'stable-updates'), (500, 'stable-security') Architecture: i386 (i686) Kernel: Linux 6.10.11-686-pae (SMP w/4 CPU threads; PREEMPT) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages cacti depends on: ii composer 2.10.2-1 ii dbconfig-common 2.0.26 ii dbconfig-mysql 2.0.26 ii debconf [debconf-2.0] 1.5.92 ii fonts-dejavu-core 2.37-9 ii fonts-dejavu-extra 2.37-9 ii javascript-common 12+nmu1 ii libapache2-mod-php 2:8.4+99 ii libapache2-mod-php8.4 [php-json] 8.4.23-1 ii libjs-chart.js 3.9.1+~cs3.1.2-3 ii libjs-jquery 3.7.1+dfsg+~3.5.33-1 ii libjs-jquery-colorpicker 1.2.20-4 ii libjs-jquery-cookie 12-4 ii libjs-jquery-hotkeys 0.2.0-1 ii libjs-jquery-jstree 3.3.17+dfsg1-1 ii libjs-jquery-metadata 12-4 ii libjs-jquery-tablesorter 1:2.31.3+dfsg1-5 ii libjs-jquery-timepicker 1.6.3-6 ii libjs-jquery-ui 1.13.2+dfsg-1 ii libjs-jquery-ui-theme-smoothness 1.14.2+dfsg-1 ii libjs-jquery-ui-theme-south-street 1.14.2+dfsg-1 ii libjs-jquery-ui-theme-ui-darkness 1.14.2+dfsg-1 ii libjs-jquery-ui-touch-punch 0.0~git20141218.2.4bc0091+dfsg1-4.1 ii libphp-phpmailer 7.1.1-1 ii node-d3 5.16.0+~cs5.28.10-3 ii node-dompurify 3.4.12+dfsg-1 ii node-fortawesome-fontawesome-free 7.3.0+ds1-1 ii node-ua-parser-js 0.8.1+ds+~0.7.36-3 ii perl 5.40.1-8 ii php 2:8.4+99 pn php-cli <none> ii php-gd 2:8.4+99 ii php-gmp 2:8.4+99 ii php-json 2:8.4+99 ii php-ldap 2:8.4+99 ii php-mbstring 2:8.4+99 ii php-mysql 2:8.4+99 ii php-phpmyadmin-motranslator 5.4.0-3 ii php-phpseclib3 3.0.55-1 ii php-snmp 2:8.4+99 ii php-twig 3.27.1-1 ii php-xml 2:8.4+99 ii php8.4 [php] 8.4.23-1 ii php8.4-cgi [php-json] 8.4.23-1 ii php8.4-cli [php-json] 8.4.23-1 ii php8.4-gd [php-gd] 8.4.23-1 ii php8.4-gmp [php-gmp] 8.4.23-1 ii php8.4-ldap [php-ldap] 8.4.23-1 ii php8.4-mbstring [php-mbstring] 8.4.23-1 ii php8.4-snmp [php-snmp] 8.4.23-1 ii php8.4-xml [php-xml] 8.4.23-1 ii rrdtool 1.9.0-2.1 ii snmp 5.9.5.2+dfsg-2.1+b1 ii ucf 3.0056 Versions of packages cacti recommends: ii apache2 [httpd] 2.4.68-1 ii default-mysql-server 1.1.1 ii iputils-ping 3:20250605-1 ii logrotate 3.22.0-1 ii mariadb-server [virtual-mysql-server] 1:11.8.8-1 Versions of packages cacti suggests: pn cacti-spine <none> ii moreutils 0.70-1 ii snmpd 5.9.5.2+dfsg-2.1+b1 -- debconf information excluded
