CVE-2026-40079: Cacti: Command Injection via escape_command() no-op in RRDtool execution
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escapecommand() function. The escapecommand() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtoolfunctiongraph() is passed through this function and then to shellexec($fullcommandline). The risk is in rrdexecute() where textformat values from graph templates (which may contain host variable substitutions) reach shellexec without adequate escaping. This issue has been addressed in version 1.2.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cactito a version that resolves this vulnerability.Fixed in 1.2.31 - Compensating control
If upgrading from Cacti 1.2.30 (or prior) to 1.2.31 is not immediately possible, mitigate command injection risk by ensuring graph template text_format values and any host variable substitutions used in templates are not attacker-controlled (so that values passed into rrdtool_function_graph()/__rrd_execute() cannot contain shell metacharacters).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40079?
CVE-2026-40079 has a risk rating of 80, indicating a high severity level.
How do I fix CVE-2026-40079?
To remediate CVE-2026-40079, upgrade to Cacti version 1.2.31 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-40079?
CVE-2026-40079 is classified as an OS Command Injection vulnerability, specifically related to command execution issues.
Which versions of Cacti are affected by CVE-2026-40079?
Cacti versions 1.2.30 and prior are vulnerable to CVE-2026-40079.
What impact does CVE-2026-40079 have on Cacti users?
CVE-2026-40079 allows attackers to execute arbitrary commands on the server, potentially compromising system security.