Read the docs
TI-2026-28809 Aliases CVE-2026-39948

Cacti has SQL Injection via rfilter parameter in RLIKE clauses

Priority MEDIUM 50CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00848 58th percentileScored 2026-11-07
Fix Fixed cacti (Cacti): 1.2.31

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cacticactibefore 1.2.311.2.31Patch availableCNA
  • cacti VendorCacti Affected before 1.2.31 Fixed in 1.2.31 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*before 1.2.31VulnerableCacti
  • cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:* Versions before 1.2.31 Vulnerable ·Cacti

Remediation

  • Fix · CNA cacti (Cacti) Fixed in 1.2.31

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39948

References

Patch 2

  • TI-2022-22813 Unauthenticated command injection in cacti KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-20500 Unauthenticated SQL Injection in graph_view.php in Cacti CVSS 3.1CRITICAL 9.8
  • TI-2024-16869 Cacti RCE vulnerability when importing packages CVSS 3.1CRITICAL 9.1
  • TI-2024-20809 SQL Injection vulnerability in automation_get_new_graphs_sql CVSS 3.1HIGH 8.8
  • TI-2023-26750 Cacti SQL Injection vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-18110 Cacti allows Arbitrary File Creation leading to RCE CVSS 4.0HIGH 8.7
See all 151 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences