As part of security fixes in 1.2.31 the realpath for script servers was
limited to `base_path` (/usr/share/cacti/site/scripts/). Debian symlinks
that to /var/lib/cacti/scripts so the security check fails.

Upstream has fixed this with commit 7015c26
(https://github.com/Cacti/cacti/pull/7320) which allows scripts to also
reside in `scripts_path`.

Please consider applying the fix (and adding script_path to
the default debian config) as a patch.

Thanks

Norman

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142799@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <elbrus@debian.org> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 26 Jul 2026 14:44:20 +0200
Source: cacti
Architecture: source
Version: 1.2.31+ds1-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Commons <cacti@packages.debian.org>
Changed-By: Paul Gevers <elbrus@debian.org>
Closes: 1142799
Changes:
 cacti (1.2.31+ds1-2) unstable; urgency=medium
 .
   * Add 0001-fix-allow-configured-external-script-root-in-script-.patch
     (Closes: #1142799)
Checksums-Sha1:
 9d001241fe5745b418263a6df72783dba47b7ac9 2455 cacti_1.2.31+ds1-2.dsc
 72e9bb965a8928bbb68a731c65de3dba752d295a 61068 cacti_1.2.31+ds1-2.debian.tar.xz
Checksums-Sha256:
 1f226f77454d023648dedd263618b81e5a8e338f99abc7e5ee6c85189e025a94 2455 cacti_1.2.31+ds1-2.dsc
 38bfedeeff49dfe40ffef7844da2d956d46c4773f8db40160d9eb71979afe30a 61068 cacti_1.2.31+ds1-2.debian.tar.xz
Files:
 a77210a95d08bc0d842dab02d117f20d 2455 web optional cacti_1.2.31+ds1-2.dsc
 5d60a5e216765d34fb69bb72672c41f2 61068 web optional cacti_1.2.31+ds1-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEG5OTVaxMNcrfvXOcBqMo4AxqzhUFAmpmCMMACgkQBqMo4Axq
zhWFhw/8CGKdQ8ViFswMdJjBlTzW0OHLOm5y6P3prET7FyKfTddDDVkQBJQC0g/4
kJAm+tHuC5Jgm1ApWqrBJaEbv/o0LpTkx6PIBrnhxmaiGt5GVdYklnqS8BgHFtGe
ML+gqv6qIqiwHMIkW15AnIO4tpV7UY1LqwGf7A1nwGWJ2/1cYthkP6CnpJO9InM3
+2tFE5qQOJuIjLoaiV79u1SYI4tHkbwSpANZunypKQ/D6MHAExx3YfhhFSlfyZTc
tQbjZv4KFn18L4TgGElBZzdQp7DgVh9PsCCvbIWtp9fxyH3e7KMFZs+VqGk71WOu
Y+P0Z+xhj6wuXnm4zGKRCYWVsVIRvNQo2fJp7Rp+2huywZ2tgYjJgOj2QfA7b0Jf
9RIRIXJ1oFQRqGI2g3USITM+mW538tCR6+edTBlh35Rv5f64x5P76kDWaqhj30Oa
m6L3XmTwymSEJel+PlaS5TWNo5G7c/V1HNm8Pu2jNBruxcTSV5ulRTvATojNafeF
ZupypT8Q66gEFVLVI3CqNtE9y9jizNOSzbpNvhV/KD278m6hDCr7/iikGWz3ybk6
xwvcRQbCNypJ408xYgq+Jf4mt73ZdhB74SZqOyWYilO3R8SHQFLv3uMXU7z9pjcg
75EtMy8jOfvLDfy+LmYl6+GMX8qupBn37nxtwVAxxuORBvysQ/w=
=OZxS
-----END PGP SIGNATURE-----