Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti
Priority LOW 30CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0085 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cacti (Cacti): 1.2.25
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cacti | cacti | before 1.2.25 | 1.2.25 | Patch available | CNA |
- cacti VendorCacti Affected before 1.2.25 Fixed in 1.2.25 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* | before 1.2.25 | Vulnerable | Cacti |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* Versions before 1.2.25 Vulnerable ·Cacti
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA cacti (Cacti) Fixed in 1.2.25
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39365
References
Other 5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/
- https://www.debian.org/security/2023/dsa-5550
- https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html
More Cacti vulnerabilities
- TI-2022-22813 Unauthenticated command injection in cacti KEVCVSS 3.1CRITICAL 9.8
- TI-2023-20500 Unauthenticated SQL Injection in graph_view.php in Cacti CVSS 3.1CRITICAL 9.8
- TI-2024-16869 Cacti RCE vulnerability when importing packages CVSS 3.1CRITICAL 9.1
- TI-2024-20809 SQL Injection vulnerability in automation_get_new_graphs_sql CVSS 3.1HIGH 8.8
- TI-2023-26750 Cacti SQL Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2025-18110 Cacti allows Arbitrary File Creation leading to RCE CVSS 4.0HIGH 8.7
Sources
- CVE-2023-39365 · CVE Program
- CVE-2023-39365 · NVD
- FIRST EPSS
- CVE-2023-39365 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences