CRITICAL🇵🇱 Wersja polska

CVE-2026-39938

CVSS 9.8v3.1pub. 2026-06-24upd. 2026-06-26

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cacti

    APP
    Cacti
    < 1.2.31
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path TraversalCommand Injection
CWE
References

Related vulnerabilities

CVE-2022-46169CRITICAL9.8⚠ KEVten sam produkt

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault manag...

CVE-2026-39948CRITICAL9.3PL ✓ten sam produkt

Cacti: Pre-auth SQL injection przez parametr rfilter (SQLi)

CVE-2026-39955CRITICAL9.8PL ✓ten sam produkt

SQL Injection przed uwierzytelnieniem w Cacti (graph_view.php)

CVE-2026-39893CRITICAL9.8PL ✓ten sam produkt

SQL Injection w Cacti — atak bez uwierzytelnienia przez parametr rfilter

CVE-2025-22604CRITICAL9.1PL ✓ten sam produkt

Cacti: Command Injection przez malformowane OID w parserze SNMP