Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M
CVE-2026-39902Cacti: Authenticated RCE on Data Input
High 7.2
In plain English
A high-severity OS command injection in cacti from Cacti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cacti | no fix listed | DEBIAN-CVE-2026-39902 |
| Debian:13 | cacti | no fix listed | DEBIAN-CVE-2026-39902 |
| Debian:14 | cacti | 1.2.31+ds1-1 | DEBIAN-CVE-2026-39902 |
| Ubuntu:24.04:LTS | cacti | no fix listed | UBUNTU-CVE-2026-39902 |
| Ubuntu:26.04:LTS | cacti | no fix listed | UBUNTU-CVE-2026-39902 |
| Ubuntu:26.10 | cacti | no fix listed | UBUNTU-CVE-2026-39902 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24 x_refsource_CONFIRM
- https://github.com/Cacti/cacti/pull/7112 x_refsource_MISC