Log in Start free

Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M

CVE-2026-39948Cacti has SQL Injection via rfilter parameter in RLIKE clauses

Critical 9.3

In plain English

A critical-severity SQL injection in cacti from Cacti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.8%top 41.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12cactino fix listedDEBIAN-CVE-2026-39948
Debian:13cactino fix listedDEBIAN-CVE-2026-39948
Debian:14cacti1.2.31+ds1-1DEBIAN-CVE-2026-39948
Ubuntu:24.04:LTScactino fix listedUBUNTU-CVE-2026-39948
Ubuntu:25.10cactino fix listedUBUNTU-CVE-2026-39948
Ubuntu:26.04:LTScactino fix listedUBUNTU-CVE-2026-39948
Ubuntu:26.10cactino fix listedUBUNTU-CVE-2026-39948

Affected products (as reported)

VendorProductVersions
Cacti cacti < 1.2.31

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References