Back to overview

CVE-2026-40079

HIGH
8.6
CVSS 4.0
Description
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandline). The risk is in __rrd_execute() where text_format values from graph templates (which may contain host variable substitutions) reach shell_exec without adequate escaping. This issue has been addressed in version 1.2.31.

Metadata

CVE ID
CVE-2026-40079
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-04-09 00:39 UTC
Published
2026-06-24 23:26 UTC
Last updated
2026-06-24 23:26 UTC
Primary CWE
CWE-78
CWE-78: Improper Neutralization of Special Elements used in …
Vendor / Product
Cacti / cacti
Sources
cve.org  ·  NVD

Severity & Metrics

8.6 HIGH CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products (1)
VendorProductPlatformVersions
Cacti cacti — < 1.2.31
Weakness (CWE)
CWESourceDescription
CWE-78 cna CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88 cna CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.6 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
References (2)
Back to overview