CVE Intelligence
Analysis AI-assisted

CVE-2026-39938: Cacti Unauthenticated Local File Inclusion (LFI) Vulnerability

CVE-2026-39938 affects Cacti versions 1.2.30 and prior, which are described as vulnerable to unauthenticated local file inclusion through graph_theme and rrdtool IPC serialization hardening. GitHub rates the issue Critical with a CVSS 3.1 base score of 9.8, and the vendor states it is resolved in version 1.2.31. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Cacti is an open source performance and fault management framework. The record describes an unauthenticated local file inclusion (LFI) issue in versions 1.2.30 and prior, linked to the graph_theme parameter and to rrdtool IPC serialization hardening. The record maps the weakness to CWE-22 (Path Traversal), and the vendor states that the issue is resolved in version 1.2.31.

Impact

  • GitHub's CVSS 3.1 vector rates confidentiality, integrity and availability as High, with a base score of 9.8 (Critical).
  • According to the vector, no privileges and no user interaction are required.
  • A successful attack could expose files on the server beyond what the application intends to share. The full scope of impact is not detailed in the sources consulted.

Affected products and versions

  • Product: Cacti (vendor and product recorded as Cacti Cacti).
  • Versions 1.2.30 and prior are described as affected, and the record lists the affected range as before 1.2.31.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record consulted. No confirmed exploitation in the wild appears in the sources consulted for this analysis. No EPSS score is present in the record.

Remediation and mitigation

  • Upgrade Cacti to version 1.2.31 or later, as stated by the vendor advisory.
  • Review the GitHub Security Advisory GHSA-rm7p-qcqm-x5m6 and the fix commit 9871f0c for details on the change.
  • Until the upgrade is applied, limit network access to Cacti web interfaces to trusted hosts and networks. This is a general defensive measure, not a vendor recommendation.

Detection guidance

  • Inventory Cacti instances and flag any running version 1.2.30 or earlier.
  • Review web server and application logs for unusual values in file-related parameters, including graph_theme, and for references to paths outside expected directories.
  • Monitor the Cacti service account for unexpected file access.

Limitations of the available information

  • The record does not provide technical reproduction details, and this analysis does not include any.
  • The description refers briefly to rrdtool IPC serialization hardening, but the precise root cause is not explained in the sources consulted.
  • The record does not state whether the fix was backported to other release branches.
  • No KEV, EPSS or SSVC data is available for scoring beyond the CVSS vector.

Frequently asked questions

Which Cacti versions are affected by CVE-2026-39938?

The record states that Cacti versions 1.2.30 and prior are affected, and the affected range is listed as versions before 1.2.31.

Has this vulnerability been fixed?

Yes. The vendor states the issue is resolved in version 1.2.31. Upgrading to that version or later is the primary remediation step.

Is this CVE being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted for this analysis.

What is the severity?

GitHub rates the issue Critical, with a CVSS 3.1 base score of 9.8 and a vector indicating network access, low complexity, no privileges and no user interaction.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.