Quick answers
- Is CVE-2026-39948 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39948 being exploited in the wild.
- How severe is CVE-2026-39948?
- Informational severity, with a CVSS score of 9.3, published 24 June 2026.
- Which products and versions are affected?
- Cacti <= 1.2.30.
- Is there a fix for CVE-2026-39948?
- A patch was published on 2026-06-24: Fix committed in version 1.2.31 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-39948 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-39948?
- Check whether you run Cacti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An unauthenticated SQL injection vulnerability exists in Cacti versions 1.2.30 and prior due to improper neutralization of the 'rfilter' request parameter. The application uses the raw accessor grv() instead of the filtered gfrv() function, allowing input to be concatenated directly into RLIKE SQL clauses within lib/html_graph.php and lib/html_tree.php. This path is reachable without authentication via graph_view.php on systems where guest graph viewing is enabled. An attacker can use unbalanced-quote payloads to bypass regex validation and execute arbitrary SQL commands. The issue is resolved in version 1.2.31 by implementing proper quoting via db_qstr_rlike().
Affected products
- Cacti Cacti <= 1.2.30
Timeline
- 2026-06-19: advisory: GitHub Security Advisory GHSA-9jqv-4cpm-vm2c published
- 2026-06-24: disclosed: CVE-2026-39948 published to NVD
- 2026-06-24: patched: Fix committed in version 1.2.31