PT-2026-52136 · Cacti · Cacti

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-39938

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

Fix

Path traversal

OS Command Injection

Weakness Enumeration

CWE-22

CWE-78

Related Identifiers

CVE-2026-39938

Affected Products

Cacti

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39938 · Security Note
• https://github.com/Cacti/cacti/commit/9871f0cef9af285398d558c9b3188d5977e01a04 · Note
• https://github.com/Cacti/cacti/security/advisories/GHSA-rm7p-qcqm-x5m6 · Note