CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-39948 — Cacti is an open source performance and fault management framework. In versions ...

·Source: NIST NVD

Updated:

Executive Summary

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installatio

Analysis

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31. CVSS Score: 9.8. Published: 2026-06-24T23:16:40.830.

Indicators of Compromise (1)

CVE (1)
CVE-2026-39948
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Standard Chartered gives institutional clients access to USDC minting and redemption

Standard Chartered has teamed up with Circle to enable its institutional clients to access USDC stablecoin minting and redemption.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-57100 — Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (Sync...

Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

CVE-2026-57100
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-45499 — Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker...

Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

CVE-2026-45499
NIST NVD