CVE-2026-39938: Cacti Path Traversal Vulnerability

CVE-2026-39938 Overview

Cacti is an open source performance and fault management framework widely deployed to collect, store, and graph time-series monitoring data. CVE-2026-39938 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting Cacti versions 1.2.30 and prior. The flaw resides in the handling of the graph_theme parameter and rrdtool inter-process communication (IPC) serialization, allowing remote attackers to traverse the filesystem and include arbitrary PHP files. The issue is tracked as CWE-22: Improper Limitation of a Pathname to a Restricted Directory and has been resolved in Cacti 1.2.31.

Critical Impact
Unauthenticated attackers can include arbitrary local files via the graph_theme parameter, leading to remote code execution, full disclosure of sensitive configuration data, and complete compromise of the Cacti server.

Affected Products

Cacti versions 1.2.30 and prior
Cacti rrdtool IPC serialization path in lib/rrd.php
Cacti graph rendering subsystem accepting graph_theme input

Discovery Timeline

2026-06-24 - CVE-2026-39938 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-39938

Vulnerability Analysis

The vulnerability is an unauthenticated Local File Inclusion in the Cacti graph rendering pipeline. When the application processes a graph request, the graph_theme value supplied through $graph_data_array is concatenated directly into a filesystem path used to include a PHP theme file. Because the input is not validated or constrained to the themes directory, attackers can inject path traversal sequences such as ../../../../etc/passwd or point to attacker-controlled PHP fragments already present on disk. The issue is compounded by weaknesses in the rrdtool IPC serialization layer, which propagates the unsanitized value across process boundaries. Successful exploitation allows arbitrary file read and PHP code execution under the privileges of the Cacti web process, providing a foothold for full host compromise.

Root Cause

The root cause is improper neutralization of pathname components [CWE-22]. The graph_theme field is concatenated into the path $config['base_path'] . '/include/themes/' . $graph_data_array['graph_theme'] . '/rrdtheme.php' without calling basename() or comparing against an allowlist of known themes. The patch in Cacti 1.2.31 introduces basename() and explicit rejection of empty, ., and .. values, falling back to the configured theme when the input is unsafe.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker issues a crafted HTTP request to a graph generation endpoint, supplying a malicious graph_theme parameter that traverses outside the themes directory. The vulnerable code then includes the attacker-chosen file as PHP, yielding arbitrary code execution on the Cacti host.

php

// Security patch in lib/rrd.php
// fix(security): validate graph_theme with basename() to prevent LFI (#6966)

if (isset($graph_data_array['graph_theme'])) {
-    $rrdtheme = $config['base_path'] . '/include/themes/' . $graph_data_array['graph_theme'] . '/rrdtheme.php';
+    $theme = basename($graph_data_array['graph_theme']);
+
+    if ($theme === '' || $theme === '.' || $theme === '..') {
+        $theme = get_selected_theme();
+    }
+
+    $rrdtheme = $config['base_path'] . '/include/themes/' . $theme . '/rrdtheme.php';
} else {
    $rrdtheme = $config['base_path'] . '/include/themes/' . get_selected_theme() . '/rrdtheme.php';
}

Source: Cacti commit 9871f0cef9af285398d558c9b3188d5977e01a04

Detection Methods for CVE-2026-39938

Indicators of Compromise

HTTP requests to Cacti graph endpoints containing graph_theme parameters with ../, ..%2f, encoded null bytes, or absolute paths outside /include/themes/.
PHP include or require errors in Cacti or web server logs referencing paths under /include/themes/ with unexpected directory components.
Unexpected child processes spawned by the Cacti web user (for example php, sh, bash, nc, or curl) following graph rendering requests.
New or modified PHP files within the Cacti webroot or /tmp that correlate in time with graph generation traffic.

Detection Strategies

Inspect web server access logs for requests to graph generation scripts that include a graph_theme value not matching the set of legitimate theme directory names.
Deploy WAF or IDS signatures that flag path traversal patterns in any graph_theme parameter targeting Cacti endpoints.
Hunt for outbound network connections originating from the Cacti host immediately following inbound graph requests, which may indicate post-exploitation callbacks.

Monitoring Recommendations

Enable verbose PHP error logging and forward logs to a centralized analytics platform to correlate inclusion failures with source IPs.
Monitor file integrity on the Cacti installation directory, particularly lib/rrd.php and the include/themes/ tree.
Alert on any process execution by the web server account that is not part of the documented Cacti polling workflow.

How to Mitigate CVE-2026-39938

Immediate Actions Required

Upgrade Cacti to version 1.2.31 or later, which applies basename() validation to the graph_theme parameter.
Restrict network access to the Cacti web interface to trusted management networks until the upgrade is applied.
Audit web server and application logs for prior exploitation attempts referencing graph_theme with path traversal sequences.
Rotate credentials, API tokens, and SNMP community strings stored within the Cacti configuration if compromise is suspected.

Patch Information

The vulnerability is fixed in Cacti 1.2.31. The fix is implemented in commit 9871f0cef9af285398d558c9b3188d5977e01a04 and described in GitHub Security Advisory GHSA-rm7p-qcqm-x5m6. The patch sanitizes the graph_theme value with basename() and rejects empty, ., or .. inputs, falling back to the configured default theme.

Workarounds

If patching is not immediately possible, deploy a WAF rule that blocks requests containing graph_theme values with ../, ..\\, URL-encoded traversal sequences, or any value not matching the allowlist of installed theme names.
Enforce PHP open_basedir restrictions to confine the Cacti process to its installation directory and prevent inclusion of files outside the application tree.
Place the Cacti interface behind authenticated reverse proxy access controls so unauthenticated traffic cannot reach the vulnerable endpoint.

bash

# Example WAF rule (ModSecurity) blocking path traversal in graph_theme
SecRule ARGS:graph_theme "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|/%2e%2e)" \
    "id:1039938,phase:2,deny,status:403,log,\
    msg:'CVE-2026-39938 Cacti graph_theme path traversal attempt'"

# Example php.ini hardening
open_basedir = /var/www/cacti:/var/lib/cacti:/tmp