CVE-2026-39955

Published Jun 24, 2026

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-39955 describes a pre-authentication SQL Injection vulnerability found in Cacti, an open-source performance and fault management framework. This flaw affects versions 1.2.30 and earlier of the software. The vulnerability specifically resides within the `graph_view.php` component, where an unanchored `FILTER_VALIDATE_REGEXP` function allows attackers to bypass input validation. By exploiting this weakness, remote unauthenticated attackers can inject malicious SQL payloads into the application's database layer through crafted input parameters. This issue has been addressed and fixed in Cacti version 1.2.31.

Description: Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php. This issue has been fixed in version 1.2.31.
Source: security-advisories@github.com
NVD status: Analyzed
Products: cacti

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5406B2E1-D53C-45AC-8F93-CFCAEDC1B5F8",
            "versionEndExcluding": "1.2.31",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.