CVE-2026-39899: Cacti Path Traversal Vulnerability

CVE-2026-39899 Overview

CVE-2026-39899 is a path traversal vulnerability in Cacti, an open source performance and fault management framework. The flaw resides in the filename parameter of package_import.php and affects versions 1.2.30 and prior. An unauthenticated remote attacker can manipulate the parameter to access files outside the intended directory. The issue is tracked under [CWE-22] and has been resolved in Cacti version 1.2.31.

Critical Impact
A network-reachable attacker can exploit the filename parameter in package_import.php to traverse the filesystem and access unintended files on the Cacti host.

Affected Products

Cacti versions 1.2.30 and prior
Fixed in Cacti version 1.2.31
Component: package_import.php

Discovery Timeline

2026-06-24 - CVE-2026-39899 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-39899

Vulnerability Analysis

The vulnerability is a path traversal flaw [CWE-22] in the Cacti package import workflow. The package_import.php script accepts a filename parameter without enforcing strict path normalization or restricting access to a designated directory. An attacker supplying traversal sequences such as ../ can escape the intended package directory and reference arbitrary files reachable by the web server process.

Cacti is widely deployed as a network monitoring frontend, and package_import.php handles template package import operations. Because the issue is reachable over the network with no privileges required, exploitation does not depend on prior authentication or user interaction. Successful exploitation results in confidentiality impact through unauthorized file access, though no integrity or availability impact is documented in the advisory.

Root Cause

The root cause is insufficient validation and sanitization of the filename parameter before it is used in file system operations within package_import.php. Directory traversal sequences are not stripped, and the resolved path is not constrained to an allow-listed base directory. The fix in version 1.2.31 introduces proper path validation, as documented in Cacti Pull Request #6899.

Attack Vector

The attack vector is network-based. An attacker crafts an HTTP request to package_import.php and supplies a malicious filename value containing directory traversal sequences. The application resolves the path and operates on the attacker-controlled location. Refer to the GitHub Security Advisory GHSA-pr9x-34w8-4mf7 for the coordinated disclosure details.

No public proof-of-concept exploit code is available at the time of publication. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is 0.344% (percentile 26.275).

Detection Methods for CVE-2026-39899

Indicators of Compromise

HTTP requests to package_import.php containing traversal sequences such as ../, ..%2f, or encoded variants in the filename parameter.
Web server access logs showing anomalous filename values referencing system paths like /etc/passwd or Cacti configuration files.
Unexpected file read operations originating from the web server user account on the Cacti host.

Detection Strategies

Inspect web access logs for POST or GET requests to package_import.php with suspicious filename parameter values.
Deploy WAF rules that flag path traversal patterns in parameters submitted to Cacti endpoints.
Correlate web request telemetry with filesystem access events on the Cacti server to identify out-of-scope reads.

Monitoring Recommendations

Enable verbose logging on the Cacti web server and forward logs to a centralized SIEM for retention and analysis.
Alert on any access to package_import.php from unauthenticated sessions or external IP addresses.
Monitor the Cacti host for read access to sensitive files outside the application's installation directory.

How to Mitigate CVE-2026-39899

Immediate Actions Required

Upgrade Cacti to version 1.2.31 or later, which contains the official fix.
Restrict network access to the Cacti management interface to trusted administrative networks only.
Audit web server and Cacti logs for prior exploitation attempts targeting package_import.php.

Patch Information

The vulnerability is fixed in Cacti version 1.2.31. The corresponding code changes are available in Cacti Pull Request #6899, and coordinated disclosure information is published in GitHub Security Advisory GHSA-pr9x-34w8-4mf7. Administrators should plan the upgrade promptly, given the network-reachable nature of the endpoint.

Workarounds

Block external access to package_import.php at the reverse proxy or WAF layer until patching is complete.
Apply WAF signatures that reject requests containing path traversal sequences in the filename parameter.
Limit Cacti administrative functionality to authenticated users on isolated management VLANs.

bash

# Configuration example - example nginx rule to block traversal patterns
location /package_import.php {
    if ($arg_filename ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
}