CVE-2020-25706

An attacker can craft a malicious template XML file whose `xml_path` field or filename contains JavaScript payloads. When an administrator imports or previews this template, the unsanitized string is rendered in the browser, causing stored XSS [CWE-79]. The attack requires the victim to import the crafted template, but no special network position is needed beyond delivering the file.

The vulnerability is in `templates_import.php` (Cacti 1.2.13). Two code paths lack proper escaping: the `xml_to_data_query()` function passes user-controlled `$path` directly into `raise_message()` without HTML escaping, and `import_display_results()` prints `$filename` without `html_escape()` [ref_id=1].

The patch replaces `__()` with `__esc()` in `xml_to_data_query()` so the error message containing the user-supplied `$path` is HTML-escaped. It also wraps `$filename` with `html_escape()` in `import_display_results()` before printing. Both changes ensure that any embedded script tags or HTML are rendered as literal text rather than executed [ref_id=1].