Stored Cross-site Scripting on data_debug.php datasource path view in Cacti

An authenticated attacker with _General Administration>Sites/Devices/Data_ permissions sets a malicious `data_source_path` containing JavaScript via a POST to `data_sources.php`. Any user who then views the poisoned data source on `data_debug.php` will have the injected script executed in their browser, because the path is rendered unescaped. The attacker only needs to lure a victim with _Troubleshooting>Data Sources_ access to the debug page for that data source.

The vulnerability is in `data_debug.php` at line 761, where the variable `$real_path` is rendered without HTML escaping when displaying the _Is RRDfile writeable by poller?_ field [ref_id=1]. The adversary injects the payload by configuring a malicious data-source path through `data_sources.php`.

Although the advisory does not include a patch diff, it recommends escaping the user-supplied `$real_path` value with HTML entities before rendering it in `data_debug.php` so that injected script tags are treated as text rather than executable code. The official fix in version 1.2.25 applies this escaping to the `$real_path` output, preventing stored XSS.