Executive brief
Cacti, an open-source network monitoring and fault management framework, is vulnerable to a security flaw that could allow unauthorized access to system files. By exploiting a weakness in how the software handles file imports, an attacker could potentially read sensitive configuration files or system data. This issue has been resolved in version 1.2.31, and users are encouraged to update to prevent unauthorized data exposure.
Technical details
A path traversal vulnerability (CWE-22) exists in Cacti versions 1.2.30 and prior within the `package_import.php` file. The vulnerability stems from insufficient validation of the `filename` parameter, which is used to construct file paths for package diff displays. An attacker can provide specially crafted input (e.g., using dot-dot-slash sequences) to bypass directory restrictions and read arbitrary files on the server that the web server process has permissions to access. The fix, introduced in version 1.2.31, implements canonical path validation using a new `validate_path_within()` helper to ensure requested files reside within the authorized directory and to prevent symlink-based TOCTOU (Time-of-Check Time-of-Use) attacks.
Affected products
- Cacti Cacti <= 1.2.30
Timeline
- 2026-03-28: patched: Initial backport of security fixes to 1.2.x branch
- 2026-06-18: advisory: GitHub Security Advisory GHSA-pr9x-34w8-4mf7 published
- 2026-06-24: disclosed: CVE-2026-39899 published to NVD