CVE-2026-39897: Cacti Reflected XSS Vulnerability

CVE-2026-39897 Overview

CVE-2026-39897 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Cacti, an open source performance and fault management framework. The flaw resides in the html_auth_footer component and impacts Cacti versions 1.2.30 and earlier. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated user, executes attacker-controlled JavaScript in the victim's browser session. The issue has been fixed in version 1.2.31.

Critical Impact
Successful exploitation enables script execution in the victim's browser context, allowing session hijacking, credential theft, or unauthorized actions against the Cacti UI. Exploitation requires user interaction (clicking a crafted link).

Affected Products

Cacti versions 1.2.30 and below
Cacti html_auth_footer component within auth and UI pages
Fixed in Cacti 1.2.31

Discovery Timeline

2026-06-24 - CVE-2026-39897 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-39897

Vulnerability Analysis

The vulnerability is a Reflected XSS issue [CWE-79] in Cacti's authentication-related UI rendering paths. User-controllable request parameters are reflected into HTML and JavaScript contexts emitted by html_auth_footer and related auth pages without adequate output encoding. The patch demonstrates two distinct exposure paths: unsafe reflection of request variables into inline JavaScript, and unvalidated use of the HTTP Referer header to drive redirects. Together these enable script injection and open redirect behavior from the auth UI surface.

Root Cause

The root cause is missing context-aware output encoding when reflecting request variables into HTML/JavaScript and missing host validation when consuming $_SERVER['HTTP_REFERER']. In auth_profile.php, the tab request variable was emitted directly into a <script> block via print get_nfilter_request_var('tab'), allowing attacker-supplied content to break out of the JavaScript string literal. In auth_changepassword.php, the referrer was used verbatim in a Location: header without confirming the host.

Attack Vector

The vulnerability is exploitable over the network and requires user interaction such as clicking a crafted link or visiting an attacker-controlled page that issues a request to a vulnerable Cacti instance. The reflected payload executes in the victim's browser within the origin of the Cacti application, enabling theft of session cookies, CSRF token exfiltration, or arbitrary UI actions on behalf of the user.

php

// Patch: auth_profile.php — JSON-encode reflected request variable
<script type='text/javascript'>

var themeFonts   = <?php print read_config_option('font_method');?>;
-var currentTab   = '<?php print get_nfilter_request_var('tab');?>';
+var currentTab   = <?php print json_encode((string) get_nfilter_request_var('tab'));?>;
var currentTheme = '<?php print get_selected_theme();?>';

Source: Cacti commit 7c544ea0

php

// Patch: auth_changepassword.php — validate Referer host before redirect
if (isset($_SERVER['HTTP_REFERER'])) {
-    header('Location: ' . $_SERVER['HTTP_REFERER']);
+    $_ref = sanitize_uri($_SERVER['HTTP_REFERER']);
+    $_ref_host = parse_url($_ref, PHP_URL_HOST);
+    $_srv_host = preg_replace('/:\d+$/', '', $_SERVER['HTTP_HOST']);
+    header('Location: ' . (($_ref_host === null || $_ref_host === $_srv_host) ? $_ref : 'index.php'));
} else {
    header('Location: index.php');
}

Source: Cacti commit 7c544ea0

The fix replaces unsafe string concatenation with json_encode() for JavaScript contexts and constrains redirects to the current host using parse_url() host comparison.

Detection Methods for CVE-2026-39897

Indicators of Compromise

Web server access logs containing requests to Cacti auth endpoints (e.g., auth_profile.php, auth_changepassword.php) with tab or other parameters containing <script>, ', \", or JavaScript event handlers.
Inbound requests carrying suspicious Referer headers pointing to attacker-controlled domains followed by 302 redirects.
Outbound requests from user browsers immediately after visiting Cacti URLs, indicating possible cookie or token exfiltration.

Detection Strategies

Inspect HTTP query strings and POST bodies for XSS payload patterns targeting Cacti URIs, particularly the tab parameter.
Correlate Cacti session cookie use from anomalous IP addresses or user agents shortly after auth page access.
Deploy a web application firewall rule to flag reflected payloads in parameters consumed by html_auth_footer and the auth pages.

Monitoring Recommendations

Centralize Cacti web server and application logs and alert on unusual Referer values or encoded script content in auth endpoints.
Monitor for unexpected administrative actions in Cacti audit logs following user clicks on external links.
Track Cacti version inventory and alert when instances running 1.2.30 or earlier appear in the environment.

How to Mitigate CVE-2026-39897

Immediate Actions Required

Upgrade all Cacti instances to version 1.2.31 or later, which contains the official fix.
Restrict network exposure of the Cacti web interface to trusted management networks or VPN access.
Invalidate active Cacti sessions after upgrade to remove any sessions established under the vulnerable code path.

Patch Information

The vulnerability is fixed in Cacti 1.2.31. The upstream patch is published in the Cacti security advisory GHSA-2j98-xfjq-gw39 and applied in commit 7c544ea0. The fix introduces json_encode() for JavaScript-context reflection and host-validated redirects in auth_changepassword.php.

Workarounds

Deploy a WAF rule blocking <, >, and JavaScript event handler patterns in query parameters sent to Cacti auth pages until patching is complete.
Enforce a strict Content-Security-Policy response header on Cacti to limit inline script execution and external script sources.
Educate administrators to avoid clicking unsolicited links pointing to internal Cacti URLs while patching is pending.

bash

# Example: upgrade Cacti to the fixed release
git fetch --tags
git checkout release/1.2.31
# Apply database upgrade per Cacti release notes, then restart the web service
sudo systemctl restart apache2