CVE-2026-39893

9.8 Critique

Publiée le 25/06/2026 à 00:16 · Modifiée le 26/06/2026 à 07:16 · Analysée par le NVD · Source : security-advisories@github.com

Description

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports guest access via the configured guest user), so the SQLi was reachable pre-auth on installs with guest viewing enabled. This issue was fixed in version 1.2.31.

Traduire en français

Produits concernés

cacti
Cacti cacti

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-89

Références

https://github.com/Cacti/cacti/pull/7039 Issue TrackingPatch
https://github.com/Cacti/cacti/security/advisories/GHSA-69gg-mjfm-jjpc Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories