PT-2026-52128 · Cacti · Cacti

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-39893

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports guest access via the configured guest user), so the SQLi was reachable pre-auth on installs with guest viewing enabled. This issue was fixed in version 1.2.31.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-39893

Produtos afetados

Cacti

Referências · 3

• https://github.com/Cacti/cacti/pull/7039 · Nota
• https://github.com/Cacti/cacti/security/advisories/GHSA-69gg-mjfm-jjpc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-39893 · Nota de Segurança