CVE-2026-39894

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31

Description Locale-dependent decimal formatting in the rrdtool function update() function can lead to the corruption of RRDtool metric values. The function validates metric values using is numeric() and incorporates them into the RRDtool update command through PHP string interpolation. Because PHP's string cast of floats is sensitive to the LC NUMERIC locale setting, environments using a comma as a decimal separator (such as de DE) will convert a value like 1.5 to "1,5". Since RRDtool requires a period as the decimal separator, this discrepancy causes metric data to be silently dropped or shifted into incorrect columns. This data integrity issue occurs when the server locale is misconfigured and is not remotely exploitable.

Recommendations Update to version 1.2.31.