CVE-2026-39902

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect...

CVE-2026-39902

Cacti, an open-source performance and fault management framework, is vulnerable to OS Command Injection (CWE-78) in versions ≤ 1.2.30 . The root cause is an incomplete blocklist that failed to filter single quotes, double quotes, redirect operators, subshell parentheses, and braces. An authentica...

CVE-2026-39902 Cacti: Authenticated RCE on Data Input

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect...

EUVD-2026-109088

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect...