CVE-2026-40079 Details
Description
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandline). The risk is in __rrd_execute() where text_format values from graph templates (which may contain host variable substitutions) reach shell_exec without adequate escaping. This issue has been addressed in version 1.2.31.
A command injection vulnerability has been identified in Cacti versions through 1.2.30. The issue arises from the escape_command() function in lib/rrd.php, which fails to properly sanitize command inputs. This function, effectively a no-op, allows unescaped text_format values from graph templates to be executed via shell_exec, creating a risk of command injection. Although the vulnerability in the rrdtool_function_tune() was previously addressed, the graph rendering path in __rrd_execute() remains vulnerable due to inadequate escaping of host variable substitutions.
Users can update to Cacti version 1.2.31, where this vulnerability has been addressed. After updating, it is recommended to review and sanitize any custom graph templates that may have been created before the update.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cacti/cacti/commit/4c09efaebf3a9faec66969d0b5c4aceaf397f37f | [email protected] | Patch |
| https://github.com/Cacti/cacti/security/advisories/GHSA-xq98-376r-hv9j | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cacti cacti | < 1.2.31 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | New CVE Received | [email protected] |