By-Poloss..-..CVE-2026-39938

CVE-2026-39938：Cacti = 1.2.30 - 未授权的本地文件包含 摘要 字段| 值 ---|--- CVE ID| CVE-2026-39938 CVSS 评分| 9.8（严重） 受影响产品| Cacti 受影响版本| = 1.2.30 修复版本| 1.2.31 修复提交| 9871f0c 漏洞详情 根本原因 该漏洞存在于 lib/rrd.php 中，其中 graphtheme 参数未经清理直接使用： 漏洞代码： root@kitploit: if isset$graphdataarray'graphtheme' $rrdtheme = $config'basepat...

CVE-2026-39938: Improper Limitation of a Pathname to a Restricted Directory

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graphtheme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31...