PT-2026-52627 · Cacti · Cacti

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-40084

Mitre

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format file Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/html reports.php at line 283 stores $save['format file'] = $post['format file'] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTI PATH FORMATS . '/' . $format file, and line 670 then calls file($format file), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40084

Affected Products

Cacti

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40084 · Security Note
• https://github.com/Cacti/cacti/security/advisories/GHSA-mjvw-mhj5-9jcj · Note
• https://github.com/Cacti/cacti/commit/4c09efaebf3a9faec66969d0b5c4aceaf397f37f · Note