CVE-2026-39948

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31

Description An unauthenticated attacker can perform SQL injection on installations where guest graph viewing is enabled. The issue occurs because the rfilter request parameter is retrieved using the raw accessor grv() instead of gfrv() with FILTER VALIDATE IS REGEX validation. This parameter is then concatenated directly into RLIKE SQL clauses within lib/html graph.php and lib/html tree.php, which are accessible pre-authentication via the graph view.php endpoint. By using an unbalanced-quote payload to bypass regex validation, an attacker can inject arbitrary SQL to compromise the database's confidentiality, integrity, and availability.

Recommendations Update to version 1.2.31. As a temporary mitigation, disable guest graph viewing to prevent unauthenticated access to the affected endpoint.