CVE-2026-71287 Details
Description
Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified.
A time-based blind SQL injection vulnerability has been identified in Cacti, specifically in the 'develop' branch. The issue arises in the 'sanitize_sql_column()' function within 'lib/functions.php', where user-supplied ORDER BY column names are sanitized using a regex allowlist. This allowlist, intended to permit only certain characters, inadvertently allows payloads like 'SLEEP(5)' to pass through unmodified. The sanitized values are then directly inserted into raw SQL ORDER BY clauses, which cannot be parameterized. This vulnerability affects all authenticated Cacti users, regardless of privilege level, and allows them to manipulate SQL queries and potentially extract sensitive information from the Cacti database.
Users can upgrade to the latest version of Cacti, where this vulnerability has been addressed. Instructions for upgrading are available in the Cacti documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cacti/cacti | TuranSec | |
| https://github.com/Cacti/cacti/blob/develop/lib/functions.php | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Cacti | < 1.2.31 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |