CVE-2026-40084: 
Cacti vulnerability analysis and mitigation

CVE-2026-40084 is a path traversal vulnerability in Cacti, an open source performance and fault management framework, that allows authenticated attackers to read arbitrary files from the server filesystem via the Report format_file parameter. All versions up to and including 1.2.30 are affected; the issue was fixed in version 1.2.31. The vulnerability was published on June 25, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and operates in two distinct stages. In the first stage (stored injection), lib/html_reports.php at line 283 stores the user-supplied format_file POST parameter directly into the database without any sanitization: $save['format_file'] = $post['format_file']. In the second stage (file read), lib/reports.php at line 667 concatenates CACTI_PATH_FORMATS . '/' . $format_file, and line 670 calls file($format_file), which reads the resolved path — including any traversal sequences — from the filesystem. Exploitation requires an authenticated user with report management privileges (realm 22). The fix applies basename() to the format_file value at both the save and load paths to strip directory traversal sequences (GitHub Advisory, GitHub Commit).

Successful exploitation allows an authenticated attacker to read arbitrary files from the server filesystem that the web server process has permission to access. This can expose highly sensitive files such as include/config.php, which contains database credentials, potentially enabling further compromise of the underlying database and lateral movement within the environment. There is no integrity or availability impact; the vulnerability is limited to confidentiality (GitHub Advisory).

1. Reconnaissance: Identify Cacti instances running version 1.2.30 or earlier using network scanning tools or Shodan. Confirm the version via the Cacti login page or version disclosure in HTTP responses.
2. Authenticate: Log in to the Cacti web interface with credentials for an account that has report management privileges (realm 22).
3. Inject path traversal payload: Send a crafted HTTP POST request to save a report with a malicious format_file parameter containing a path traversal sequence:

POST /cacti/reports.php
action=save&save_component_report=1&id=1&format_file=../../include/config.php&...

4. Persist the payload: The unsanitized format_file value is stored directly in the Cacti database via lib/html_reports.php line 283.
5. Trigger file read: View or generate the saved report. Cacti's lib/reports.php concatenates the stored traversal path with CACTI_PATH_FORMATS and calls file(), reading the target file (e.g., config.php) and returning its contents in the report output.
6. Extract sensitive data: Review the report output to obtain the contents of the target file, such as database credentials from config.php (GitHub Advisory).

• Network: HTTP POST requests to /cacti/reports.php with action=save and a format_file parameter containing ../ or ..\ sequences; subsequent GET requests to view or generate the same report ID.
• Logs: Web server access logs showing POST requests to reports.php with encoded or plaintext path traversal strings (e.g., format_file=../../include/config.php); Cacti application logs showing report generation for reports with unusual format file names.
• Database: Entries in the Cacti reports table where the format_file column contains path traversal sequences (e.g., values starting with ../ or absolute paths) rather than simple filenames.
• File System: No direct file system artifacts are created by exploitation, but access to sensitive files (e.g., include/config.php) may be reflected in OS-level file access audit logs if enabled (GitHub Advisory).

Upgrade Cacti to version 1.2.31 or later, which applies basename() to the format_file parameter at both the save (lib/html_reports.php) and load (lib/reports.php) stages, preventing path traversal. As a workaround prior to patching, restrict report creation privileges to fully trusted users only and implement web application firewall (WAF) rules to reject requests containing ../ or ..\ in the format_file parameter. Additionally, monitor file access logs for suspicious read patterns targeting sensitive configuration files (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher TristanInSec and coordinated by netniV from the Cacti project, who published the advisory on June 19, 2026. Red Hat tracked the issue via Bugzilla (Bug 2493262) and assigned it a medium severity rating. No significant broader media coverage or notable social media commentary beyond standard CVE tracking feeds has been observed (GitHub Advisory, Red Hat Bugzilla).