Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti

An authenticated attacker with 'General Administration > Sites/Devices/Data' permissions POSTs a malicious `data_source_path` parameter to `data_sources.php?action=save`, embedding JavaScript inside the path (e.g. `<img src=x onerror=alert(1)>`). Any user who subsequently views that data source with `debug=1` on `data_sources.php?action=ds_edit&id=X&debug=1` will have the stored payload rendered raw in the debug `<pre>` block, causing the script to execute in the victim's browser. This is a Stored XSS attack [CWE-79] [ref_id=1].

The vulnerability resides in `data_sources.php` at line 1166, where the output of `@rrdtool_function_create(get_request_var('id'), true)` is inserted as raw HTML inside a `<pre>` block without escaping. The advisory identifies that the same page is used for both configuring and previewing the data-source path, making it possible for a malicious path to be stored and later rendered unsanitized.

The fix (since version 1.2.25) requires that user-supplied data rendered in the debug output be HTML-escaped before it is included in the page. The advisory recommends either making the debug output a text-only element or escaping the content with HTML entities so that any injected script tags or event handlers are displayed as literal text rather than executed. No patch diff is shown in the bundle, but the remediation guidance is clear.