CVE-2026-40084

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31

Description Cacti is an open source performance and fault management framework. A path traversal issue allows for arbitrary file read through the Report format file parameter. The process occurs in two stages: first, a stored injection where lib/html reports.php stores the format file value into the database without validation; second, lib/reports.php concatenates the value with a path and uses the file() function to read arbitrary files from the filesystem.

Recommendations Update to version 1.2.31.