CVE-2026-40079

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31

Description Command Injection occurs due to insufficient sanitization in the escape command() function located at lib/rrd.php, which acts as a no-op by returning the $command unchanged. The command line constructed by rrdtool function graph() is passed through this function and subsequently executed via shell exec($full commandline). The risk is present in rrd execute(), where text format values from graph templates, potentially containing host variable substitutions, reach shell exec without proper escaping.

Recommendations Update to version 1.2.31.