Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graphview.php script. An authenticated user can inject arbitrary shell commands via the graphstart GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying operating system with the privileges of the web server process, potentially compromising system integrity.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selecteditems by calling cactiunserialize(stripslashes(gnrv('selectedgraphsarray'))). The cactiunserialize() function calls unserialize() with allowedclasses set to false, which prevents object injection but still allows arbitrary string arrays to be deserialized. Then, at lines 760 to 766, the deserialized array values are passed directly into dbexecute('DELETE FROM snmpagentmanagers WHERE id IN (' . implode(',', $selecteditems) . ')'), where they are imploded into the SQL statement without any integer validation, resulting in SQL Injection when using SNMP agent management permissions. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at strcontains($referer, CACTIPATHURL). When the user's loginopts == '1' (redirect to referer after login), the function used $SERVER['HTTPREFERER'] directly. An attacker could craft a referer such as https://evil.com/cacti/. Where CACTIPATHURL is /cacti/, the substring matches and the user is redirected to evil.com after login. The pre-existing validateredirecturl() helper at lib/htmlutility.php performed proper validation but was not invoked from authloginredirect(). This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing sessionregenerateid() after login, leading to Session Fixation. sessionregenerateid() is NOT called after successful login. The login flow at authlogin.php:203-207 directly sets $SESSION[SESSUSERID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report formatfile Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/htmlreports.php at line 283 stores $save['formatfile'] = $post['formatfile'] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTIPATHFORMATS . '/' . $formatfile, and line 670 then calls file($formatfile), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graphnameregexp in the Reports feature. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTERVALIDATEREGEXP in graphview.php. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTERVALIDATEISREGEX validation) and concatenated directly into RLIKE SQL clauses in lib/htmlgraph.php and lib/htmltree.php, which are reachable pre-authentication through graphview.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports guest access via the configured guest user), so the SQLi was reachable pre-auth on installs with guest viewing enabled. This issue was fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graphtheme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal via filename parameter in packageimport.php. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escapecommand() function. The escapecommand() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtoolfunctiongraph() is passed through this function and then to shellexec($fullcommandline). The risk is in rrdexecute() where textformat values from graph templates (which may contain host variable substitutions) reach shellexec without adequate escaping. This issue has been addressed in version 1.2.31.

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtoolfunctionupdate() can corrupt RRDtool metric values. The rrdtoolfunctionupdate() function checks metric values with isnumeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LCNUMERIC uses comma as decimal separator (e.g., deDE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the htmlauthfooter. This issue has been fixed in version 1.2.31.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the authprofile.php JavaScript context. This issue has been fixed in version 1.2.31.

Cacti through 1.2.29 allows SQL injection in the template function in hosttemplates.php via the graphtemplate parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146.

Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of pollerautomation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.

Cacti 1.2.8 has stored XSS in datasources.php, colortemplatesitem.php, graphs.php, graphitems.php, lib/apiautomation.php, useradmin.php, and usergroupadmin.php, as demonstrated by the description parameter in datasources.php (a raw string from the database that is displayed by $header to trigger the XSS).

DISPUTED datainput.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host. NOTE: the vendor has stated "This is a false alarm."

Cacti bug#0002405 includes fixes for SQL injection and shell escaping (which could lead to arbitrary command execution). Fixes are available from:

http://svn.cacti.net/viewvc?view=rev&revision=7439

CVE-2014-2708 is for the SQL injection issues in graphxport.php.

CVE-2014-2709 is for the shell escaping issues in lib/rrd.php

References:

http://seclists.org/oss-sec/2014/q2/15

lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.

Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.

lib/graphexport.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.

Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

During recent testing on Cacti, an authenticated remote code execution vulnerability was discovered that allows users with graph management privileges to execute arbitrary commands on the underlying OS.

The vulnerability originates from Cacti's variable substitution engine, which allows graph templates to reference host metadata through variables such as |host\description|, |host\hostname|, and |host\notes|. During graph generation, these variables are expanded and incorporated into arguments passed to RRDtool.

Because user-controlled host metadata is substituted without sufficient validation or sanitization, an attacker can inject malicious input into a host field and trigger code execution when a graph is rendered.

This issue affects Cacti versions ≤ 1.2.30 and has been assigned CVE-2026-39949.

Link to the writeup: https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2026-39949.md Link to the POC: https://github.com/lukehebe/CVE-2026-39949/tree/main Link to Cacti changelog: https://github.com/Cacti/cacti/blob/develop/CHANGELOG#L231

SQL injection vulnerability in templatesexport.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the exportitemid parameter.

SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rraid parameter in a GET request in conjunction with a valid rraid value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $GET value into the resulting query.