SB20260619121 - Multiple vulnerabilities in Cacti

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260619121

SB20260619121 - Multiple vulnerabilities in Cacti

Published: June 19, 2026 Updated: July 28, 2026

Security Bulletin ID SB20260619121
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 18
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 22% Medium 39% Low 39%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 18 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-39938)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read arbitrary files.

The vulnerability exists due to path traversal in the graph_theme parameter when handling requests. A remote attacker can send a specially crafted request to read arbitrary files.


2) OS Command Injection (CVE-ID: CVE-2026-39902)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to command injection in data input when processing user-supplied input. A remote privileged user can send specially crafted input to execute arbitrary code.


3) SQL injection (CVE-ID: CVE-2026-40083)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in managers.php when processing crafted POST parameters for manager actions. A remote privileged user can submit a specially crafted selected_graphs_array value to execute arbitrary SQL commands.

Exploitation requires SNMP agent management permissions.


4) Observable Response Discrepancy (CVE-ID: CVE-2026-49442)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to enumerate valid usernames.

The vulnerability exists due to observable response discrepancy in the login page when handling login attempts. A remote attacker can submit login requests with different usernames to enumerate valid usernames.

The responses differ only by the capitalization of the word "failed" in the error message.


5) Path traversal (CVE-ID: CVE-2026-40084)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in the report format_file parameter handling in lib/html_reports.php and lib/reports.php when saving and loading report definitions. A remote user can submit a specially crafted format_file value and then generate or view the report to disclose sensitive information.

Exploitation requires report management permission in realm 22.


6) OS Command Injection (CVE-ID: CVE-2026-40079)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to command injection in lib/rrd.php __rrd_execute() and escape_command() when processing graph template text_format values with host variable substitutions for RRDtool execution. A remote user can supply crafted text_format values to execute arbitrary commands.

The issue affects the graph rendering shell_exec path, while the previously vulnerable tune function is described as already fixed.


7) Open redirect (CVE-ID: CVE-2026-40080)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an untrusted site.

The vulnerability exists due to improper input validation in auth_login_redirect() in lib/auth.php when processing the HTTP_REFERER value during the login flow. A remote attacker can supply a crafted referer value to redirect users to an untrusted site.

User interaction is required, and the issue occurs when the user's login option is set to redirect to the referer after login.


8) SQL injection (CVE-ID: CVE-2026-39948)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the rfilter parameter handling in graph_view.php and related RLIKE query sites when handling user-supplied rfilter input. A remote attacker can send a specially crafted request to execute arbitrary SQL commands.

The pre-authentication vector reaches the SQL sink through raw grv('rfilter') usage, while sites that validate the parameter with regex filtering are not affected by this specific injection pattern.


9) SQL injection (CVE-ID: CVE-2026-39955)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL commands.

The vulnerability exists due to sql injection in graph_view.php when handling crafted input validated with an unanchored regular expression. A remote attacker can send a specially crafted request to execute arbitrary SQL commands.


10) SQL injection (CVE-ID: CVE-2026-46531)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in create_all_header_nodes() in lib/api_automation.php when processing a stored field value from automation_tree_rule_items.field during automation rule execution. A remote privileged user can store a crafted SQL fragment that is later executed to disclose sensitive information.

The injected query result is written into graph_tree_items.title and rendered in the Cacti tree UI. Exploitation requires an administrator to trigger the standard Apply Automation Rules bulk action.


11) SQL injection (CVE-ID: CVE-2026-39893)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in graph_view.php when processing the rfilter request variable in graph filter requests. A remote attacker can send a specially crafted request to execute arbitrary SQL commands.

The issue is reachable without authentication on installations with guest viewing enabled.


12) Session Fixation (CVE-ID: CVE-2026-40082)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to hijack a user's authenticated session.

The vulnerability exists due to session fixation in auth_login.php and include/auth.php when processing login requests. A remote attacker can set a known session identifier in the victim's browser and wait for the victim to log in to hijack a user's authenticated session.

User interaction is required because the victim must log in using the attacker-fixed session identifier.


13) Cross-site scripting (CVE-ID: CVE-2026-39897)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in a user's browser.

The vulnerability exists due to cross-site scripting in html_auth_footer error message output when handling crafted input in error messages. A remote attacker can supply specially crafted input to execute arbitrary script in a user's browser.


14) Cross-site scripting (CVE-ID: CVE-2026-39900)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to cross-site scripting in auth_profile.php when processing the tab parameter in a JavaScript string context. A remote attacker can send a specially crafted request to execute arbitrary script in the victim's browser.


15) Path traversal (CVE-ID: CVE-2026-39899)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access files outside the intended directory.

The vulnerability exists due to path traversal in the filename parameter of package_import.php when handling package import requests. A remote user can supply a crafted filename parameter to access files outside the intended directory.


16) SQL injection (CVE-ID: CVE-2026-39951)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and modify data.

The vulnerability exists due to SQL injection in the Reports feature when processing the graph_name_regexp parameter. A remote user can supply a specially crafted graph_name_regexp value to disclose sensitive information and modify data.


17) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-40941)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass package signature validation and import self-signed packages.

The vulnerability exists due to improper verification of cryptographic signature in the package import signature validation mechanism when processing package imports. A remote attacker can supply a self-signed package to bypass package signature validation and import self-signed packages.


18) Use of Function with Inconsistent Implementations (CVE-ID: CVE-2026-39894)

CWE-ID: CWE-474 - Use of Function with Inconsistent Implementations

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt metric values.

The vulnerability exists due to use of function with inconsistent implementations in rrdtool_function_update() when formatting numeric metric values for RRDtool updates. A remote attacker can cause locale-sensitive comma decimal formatting to be used to corrupt metric values.

Exploitation requires the server to use an LC_NUMERIC locale with a comma decimal separator.


Remediation

Install update from vendor's website.

References