CVE-2026-40084: Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report formatfile Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/htmlreports.php at line 283 stores $save['formatfile'] = $post['formatfile'] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTIPATHFORMATS . '/' . $formatfile, and line 670 then calls file($formatfile), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cactito a version that resolves this vulnerability.Fixed in 1.2.31
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40084?
The severity of CVE-2026-40084 is rated as medium with a score of 6.5.
What is CVE-2026-40084?
CVE-2026-40084 is a vulnerability in Cacti that allows for arbitrary file read via path traversal in the Report format_file parameter.
How do I fix CVE-2026-40084?
To fix CVE-2026-40084, upgrade Cacti to version 1.2.31 or later where the vulnerability is patched.
What types of impacts are possible with CVE-2026-40084?
CVE-2026-40084 can lead to unauthorized access to sensitive files on the server due to arbitrary file reading.
Which versions of Cacti are affected by CVE-2026-40084?
CVE-2026-40084 affects Cacti versions 1.2.30 and prior.