Executive brief
Cacti, an open-source network monitoring and fault management framework, is vulnerable to a security flaw that could allow an administrative user to execute unauthorized commands on the underlying server. This occurs because the system fails to properly sanitize certain text inputs used when generating performance graphs. An attacker with high-level privileges could exploit this to gain full control over the server, potentially leading to data theft or service disruption.
Technical details
A command injection vulnerability exists in Cacti's RRDtool execution path within `lib/rrd.php`. The `escape_command()` function, intended to sanitize shell commands, was implemented as a no-op that returns the input string unchanged. When `rrdtool_function_graph()` builds a command line, it incorporates `text_format` values from graph templates—which may include host variable substitutions—and passes them to `shell_exec()` via `__rrd_execute()` without adequate escaping. An attacker with sufficient privileges to modify graph templates or host variables can inject arbitrary OS commands. This issue is addressed in version 1.2.31 by implementing proper sanitization and hardening the command execution path.
Affected products
- Cacti Cacti <= 1.2.30
Timeline
- 2026-06-19: advisory: GitHub Security Advisory GHSA-xq98-376r-hv9j published
- 2026-06-25: disclosed: CVE-2026-40079 published to NVD
- 2026-06-25: patched: Fixed in version 1.2.31