CVE-2026-39899

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31

Description Cacti is an open source performance and fault management framework. The software contains a path traversal flaw in the 'package import.php' endpoint, where the filename parameter is not properly validated. Path traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations Update to version 1.2.31. Avoid using the filename parameter in the 'package import.php' endpoint until the update is applied.