VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jun 24, 2026· Updated Jun 26, 2026

CVE-2026-39893

CVE-2026-39893

Description

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports guest access via the configured guest user), so the SQLi was reachable pre-auth on installs with guest viewing enabled. This issue was fixed in version 1.2.31.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Cacti (software)/Cacti2 versions
    cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*range: <1.2.31
    • (no CPE)range: <=1.2.30

Patches

Vulnerability mechanics

References

2

News mentions

1