kx00007/cve-2026-39938Detailed CVE-2026-39938 vulnerability report for Cacti ≤1.2.30, demonstrating unauthenticated LFI chained to OS command injection RCE with PoC, root cause analysis, and remediation guidance.
| Field | Value |
|---|
| Product | Cacti — The Complete RRDtool-based Graphing Solution |
| Affected Version(s) | ≤ 1.2.30 |
| Vulnerability Class | CWE-22: Path Traversal (LFI) → CWE-78: OS Command Injection |
| Attack Vector | Network |
| Authentication | None required (guest account bypass) |
| User Interaction | None |
| CVSSv3.1 Score | 9.8 — CRITICAL |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Cacti ≤ 1.2.30 is vulnerable to unauthenticated Local File Inclusion (LFI) via the graph_theme parameter in graph_image.php, chained to Remote Code Execution (RCE) through OS command injection via cacti_escapeshellarg() on Windows.
HTTP Request
│
▼
graph_image.php
│
├── $guest_account = true → Auth bypass (no login needed)
│
├── graph_theme param → LFI (CWE-22)
│ └── Path traversal via basename() bypass
│
└── Other params (graph_height, etc.)
└── cacti_escapeshellarg() → OS injection (CWE-78)
└── proc_open() → RCE
graph_themeThe graph_theme parameter is insufficiently sanitized. The fix attempted to use basename() but this is trivially bypassable — a path like themes/../../etc/passwd passes basename() validation while still traversing directories.
Vulnerable code path in graph_image.php:
$theme = basename($_GET['graph_theme']); // basename() is NOT sufficient
include_once("./include/theme_" . $theme . ".php"); // LFI
The fix in 1.2.31 replaces basename() with cacti_validate_theme(), which uses a filesystem allowlist.
| Condition | Likelihood | Notes |
|---|---|---|
| Cacti runs on Windows | Common in enterprise | cmd.exe escaping flaw enables RCE |
| Guest account enabled | Common — often default | Guest user allows public graph viewing |
| At least one graph exists | Near universal | local_graph_id=1 present after install |
| RRDtool installed | Required by Cacti | Always present |
GET /cacti/graph_image.php?local_graph_id=1&graph_theme=../../../../etc/passwd
GET /cacti/graph_image.php?local_graph_id=1&graph_height=100" & whoami & "&action=view
The OS command injection already provides direct Remote Code Execution (RCE), so LFI is not required to achieve compromise.
However From a researcher perspective, if both issues are considered together:
This shows that combining multiple vulnerabilities increases the overall impact and makes exploitation easier and more reliable.
| Pillar | Rating | Description |
|---|---|---|
| Confidentiality | HIGH | Full read access to web server filesystem (config, DB creds) |
| Integrity | HIGH | Arbitrary command execution, web shell deployment |
| Availability | HIGH | Process termination, file corruption, DoS |
| Metric | Value |
|---|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
Score: 9.8 — CRITICAL
| Priority | Action |
|---|---|
| Immediate | Upgrade to Cacti 1.2.31 or later |
MENG HOKSENG
Independent Security Researcher
References: