Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 24, 2026
Multiple input-validation and injection weaknesses in Cacti, the open-source network/operational monitoring and fault-management framework, are remediated in version 1.2.31 (Alpine package 1.2.31-0). The Alpine advisory and NVD classify the issue as SQL injection (CWE-89, CVSS 9.8), but the referenced upstream commit is a security rollup that fixes command injection in the data-input handler, CSV/formula injection in host and device exports, and a path-traversal in the external-links iframe loader. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Earlier versions of this analysis (2)
Multiple input-validation weaknesses in the Cacti network monitoring web application are resolved in release 1.2.31, packaged by Alpine Linux as cacti 1.2.31-0. The Alpine tracker classifies the issue as SQL injection (CWE-89, CVSS 9.8), though the referenced upstream commit also hardens against OS command injection in the data-input editor, CSV formula injection in device/host exports, and path traversal in external-link rendering. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Insufficient disclosure data prevents characterizing the specific impact of CVE-2026-39955 in Cacti. Alpine Linux issued a patched package at version 1.2.31-0, indicating the upstream Cacti project addressed an undisclosed vulnerability. No public description, CVSS score, CWE classification, or exploitation details are available at this time, making risk characterization impossible without additional vendor disclosure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Cacti gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable web app (AV:N/AC:L), but the affected data-input/export/console functions require an authenticated session, so PR:L rather than PR:N; injection yields full C/I/A impact.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
3DescriptionCVE.org
Alpine Linux: cacti fixed in 1.2.31-0
Executive ViewAI
Cacti network monitoring framework versions prior to 1.2.31 contain multiple critical injection vulnerabilities-SQL injection, command injection, CSV formula injection, and path traversal-affecting data input handlers, export functions, and external-link loaders. Successful exploitation could grant attackers command execution on the Cacti server and monitored infrastructure, directly compromising operational visibility and control of critical assets.
Within 24 hours: Identify all Cacti deployments; document current versions; verify network segmentation; review access logs for exploitation attempts. Within 7 days: Obtain and validate Cacti 1.2.31 (Alpine package 1.2.31-0) in non-production environment; test data-input handlers, host/device exports, and external-links functionality. Within 30 days: Deploy Cacti 1.2.31 to all production systems; verify monitoring continuity; audit logs for signs of prior exploitation.
Apply vendor patch (Cacti 1.2.31, Alpine package 1.2.31-0).
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Cacti monitoring platform prior to version 1.2.29 allows authenticated users to achieve remote code execution through th
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management fram
Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerabil
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB).
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. Rated high se
Cacti is an open source operational monitoring and fault management framework. Rated critical severity (CVSS 9.8), this
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary S
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQ
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitra
Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerabil
Cacti is an open source operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vuln
Exploit-DB