CVE-2026-39938

Published Jun 24, 2026

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-39938 identifies an unauthenticated Local File Inclusion (LFI) vulnerability affecting Cacti, an open-source performance and fault management framework. This flaw is present in versions 1.2.30 and earlier of the software. The vulnerability arises from insufficient input validation within the `graph_theme` and `rrdtool` IPC serialization components. Exploitation of CVE-2026-39938 allows remote attackers to manipulate file inclusion parameters without requiring any authentication credentials. This can enable unauthorized access to arbitrary files on the system, potentially exposing sensitive information such as configuration files, database credentials, and other internal system data. The issue has been resolved in Cacti version 1.2.31.

Description: Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.
Source: security-advisories@github.com
NVD status: Analyzed
Products: cacti

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5406B2E1-D53C-45AC-8F93-CFCAEDC1B5F8",
            "versionEndExcluding": "1.2.31",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.