Executive brief
Cacti, an open-source network monitoring and fault management framework, is vulnerable to a security flaw that allows authenticated users to read sensitive files from the server's filesystem. By exploiting a weakness in how report formats are handled, an attacker could access critical data such as database credentials or system configuration files. This could lead to a full compromise of the monitoring server and the data it manages.
Technical details
A path traversal vulnerability exists in Cacti versions 1.2.30 and prior due to insufficient validation of the 'format_file' parameter in the reporting module. The exploit occurs in two stages: first, an attacker with report management permissions (Realm 22) performs a stored injection by saving a malicious path into the database via 'lib/html_reports.php'. Second, when the report is generated, 'lib/reports.php' concatenates this unvalidated string with a base directory and passes it to the 'file()' function. This allows a remote authenticated attacker to bypass directory restrictions and read sensitive files, such as 'config.php', which contains database credentials. The issue is resolved in version 1.2.31 by implementing 'basename()' validation on the input.
Affected products
- Cacti Cacti <= 1.2.30
Timeline
- 2026-04-12: patched: Fix committed to repository
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published to NVD