CVE-2026-71287: Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection
Cacti's sanitizesqlcolumn (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71287?
The severity of CVE-2026-71287 is high, rated at 8.8 on the CVSS scale.
What type of vulnerability is CVE-2026-71287?
CVE-2026-71287 is classified as a SQL Injection vulnerability.
How does CVE-2026-71287 affect Cacti?
CVE-2026-71287 allows for the execution of SQL time-delay functions, leading to a blind SQL injection attack.
How can I mitigate CVE-2026-71287?
To mitigate CVE-2026-71287, ensure that user-supplied input in ORDER BY clauses is properly validated and sanitized.
Is there a patch available for CVE-2026-71287?
Check the official Cacti repository or release notes for any patches addressing CVE-2026-71287.