Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M
CVE-2026-40079Cacti: Command Injection via escape_command() no-op in RRDtool execution
High 8.6
In plain English
A high-severity OS command injection in cacti from Cacti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandline). The risk is in __rrd_execute() where text_format values from graph templates (which may contain host variable substitutions) reach shell_exec without adequate escaping. This issue has been addressed in version 1.2.31.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cacti | no fix listed | DEBIAN-CVE-2026-40079 |
| Debian:13 | cacti | no fix listed | DEBIAN-CVE-2026-40079 |
| Debian:14 | cacti | 1.2.31+ds1-1 | DEBIAN-CVE-2026-40079 |
| Ubuntu:24.04:LTS | cacti | no fix listed | UBUNTU-CVE-2026-40079 |
| Ubuntu:25.10 | cacti | no fix listed | UBUNTU-CVE-2026-40079 |
| Ubuntu:26.04:LTS | cacti | no fix listed | UBUNTU-CVE-2026-40079 |
| Ubuntu:26.10 | cacti | no fix listed | UBUNTU-CVE-2026-40079 |
Affected products (as reported)
Weakness: CWE-78, CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
References
- https://github.com/Cacti/cacti/security/advisories/GHSA-xq98-376r-hv9j x_refsource_CONFIRM
- https://github.com/Cacti/cacti/commit/4c09efaebf3a9faec66969d0b5c4aceaf397f37f x_refsource_MISC