Is CVE-2026-39899 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39899 being exploited in the wild.

How severe is CVE-2026-39899?

Informational severity, with a CVSS score of 6.9, published 24 June 2026.

Is there a fix for CVE-2026-39899?

A patch was published on 2026-03-28: Initial backport of security fixes to 1.2.x branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39899 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39899?

Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39899: Cacti path traversal in package_import.php

CVE-2026-39899 · Severity: info · CVSS 6.9 · Published 2026-06-24

Cacti, an open-source network monitoring and fault management framework, is vulnerable to a security flaw that could allow unauthorized access to system files. By exploiting a weakness in how the software handles file imports, an attacker could potentially read sensitive configuration files or system data. This issue has been resolved in version 1.2.31, and users are encouraged to update to prevent unauthorized data exposure.

Technologies: Cacti. Vendors: Cacti.

Quick answers

Is CVE-2026-39899 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39899 being exploited in the wild.
How severe is CVE-2026-39899?: Informational severity, with a CVSS score of 6.9, published 24 June 2026.
Which products and versions are affected?: Cacti <= 1.2.30.
Is there a fix for CVE-2026-39899?: A patch was published on 2026-03-28: Initial backport of security fixes to 1.2.x branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39899 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39899?: Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Cacti versions 1.2.30 and prior within the `package_import.php` file. The vulnerability stems from insufficient validation of the `filename` parameter, which is used to construct file paths for package diff displays. An attacker can provide specially crafted input (e.g., using dot-dot-slash sequences) to bypass directory restrictions and read arbitrary files on the server that the web server process has permissions to access. The fix, introduced in version 1.2.31, implements canonical path validation using a new `validate_path_within()` helper to ensure requested files reside within the authorized directory and to prevent symlink-based TOCTOU (Time-of-Check Time-of-Use) attacks.

Affected products

Cacti Cacti <= 1.2.30

Timeline

2026-03-28: patched: Initial backport of security fixes to 1.2.x branch
2026-06-18: advisory: GitHub Security Advisory GHSA-pr9x-34w8-4mf7 published
2026-06-24: disclosed: CVE-2026-39899 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.