Executive brief
Cacti is an open-source platform used by organizations to monitor network performance and manage IT infrastructure. A security flaw in the graph viewing component allows unauthenticated attackers to execute unauthorized database commands. This could lead to the theft of sensitive configuration data, modification of monitoring records, or a complete takeover of the monitoring server.
Technical details
A SQL injection vulnerability exists in `graph_view.php` within Cacti versions 1.2.30 and prior. The `rfilter` request parameter is concatenated directly into an `RLIKE` SQL clause without proper sanitization or parameterization. Because Cacti often supports guest access for graph viewing, this endpoint can be reached by unauthenticated attackers over the network if guest access is enabled. An attacker can exploit this to execute arbitrary SQL queries, potentially leading to full database compromise (Confidentiality, Integrity, and Availability impact). The issue was resolved in version 1.2.31 by implementing the `db_qstr_rlike()` helper function to sanitize input and enforce length limits.
Affected products
- Cacti Cacti <= 1.2.30
Timeline
- 2026-04-17: other: Internal audit completed by Cacti team
- 2026-04-26: patched: Fix merged into 1.2.x branch
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD