SQL injection in Cacti - CVE-2026-39948
Published: June 22, 2026
Vulnerability identifier: #VU134988
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-39948
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL commands.
The vulnerability exists due to SQL injection in the rfilter parameter handling in graph_view.php and related RLIKE query sites when handling user-supplied rfilter input. A remote attacker can send a specially crafted request to execute arbitrary SQL commands.
The pre-authentication vector reaches the SQL sink through raw grv('rfilter') usage, while sites that validate the parameter with regex filtering are not affected by this specific injection pattern.
Affected software
Cacti
How to mitigate CVE-2026-39948
Install security update from vendor's website.
Cacti - update to 1.2.31