CVE-2026-39902

A flaw was found in Cacti. This vulnerability allows an authenticated attacker with administrative privileges to execute arbitrary commands on the underlying host system. An incomplete character blocklist fails to properly restrict shell metacharacters—such as quotes, redirect operators, and...