p PatchFirst

CVE-2026-39938

CVE-2026-39938 · Cacti: Unauthenticated RCE on Graph Image

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

CVSS 9.8 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • cacti

    Versions
    • < 1.2.31: Affected

    No fix published

  • cacti Debian:12

    Versions
    • 1.2.24+ds1-1
    • 1.2.24+ds1-1+deb12u1
    • 1.2.24+ds1-1+deb12u2
    • 1.2.24+ds1-1+deb12u3
    • 1.2.24+ds1-1+deb12u4
    • 1.2.24+ds1-1+deb12u5
    • 1.2.25+ds1-1
    • 1.2.25+ds1-2
    • 1.2.26+ds1-1
    • 1.2.27+ds1-1
    • 1.2.27+ds1-2
    • 1.2.28+ds1-1
    • 1.2.28+ds1-2
    • 1.2.28+ds1-3
    • 1.2.28+ds1-4
    • 1.2.30+ds1-1
    • 1.2.30+ds1-2
    • 1.2.30+ds1-3
    • 1.2.31+ds1-1
    • 1.2.31+ds1-2
    • 1.2.31+ds1-3
    • 1.2.31+ds1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Debian:13

    Versions
    • 1.2.30+ds1-1
    • 1.2.30+ds1-2
    • 1.2.30+ds1-3
    • 1.2.31+ds1-1
    • 1.2.31+ds1-2
    • 1.2.31+ds1-3
    • 1.2.31+ds1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Debian:14

    Versions
    • 1.2.30+ds1-1
    • 1.2.30+ds1-2
    • 1.2.30+ds1-3
    Affected ranges
    • ECOSYSTEM: < 1.2.31+ds1-1

    Update to 1.2.31+ds1-1

  • cacti Ubuntu:Pro:14.04:LTS

    Versions
    • 0.8.8b+dfsg-3
    • 0.8.8b+dfsg-5
    • 0.8.8b+dfsg-5ubuntu0.1
    • 0.8.8b+dfsg-5ubuntu0.2
    • 0.8.8b+dfsg-5ubuntu0.2+esm1
    • 0.8.8b+dfsg-5ubuntu0.2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Ubuntu:Pro:16.04:LTS

    Versions
    • 0.8.8f+ds1-2
    • 0.8.8f+ds1-3
    • 0.8.8f+ds1-4
    • 0.8.8f+ds1-4ubuntu1
    • 0.8.8f+ds1-4ubuntu2
    • 0.8.8f+ds1-4ubuntu3
    • 0.8.8f+ds1-4ubuntu4
    • 0.8.8f+ds1-4ubuntu4.16.04
    • 0.8.8f+ds1-4ubuntu4.16.04.1
    • 0.8.8f+ds1-4ubuntu4.16.04.2
    • 0.8.8f+ds1-4ubuntu4.16.04.2+esm1
    • 0.8.8f+ds1-4ubuntu4.16.04.2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Ubuntu:Pro:18.04:LTS

    Versions
    • 1.1.18+ds1-1
    • 1.1.27+ds1-2
    • 1.1.27+ds1-3
    • 1.1.28+ds1-2
    • 1.1.35+ds1-1
    • 1.1.36+ds1-1
    • 1.1.38+ds1-1
    • 1.1.38+ds1-1ubuntu0.1~esm1
    • 1.1.38+ds1-1ubuntu0.1~esm3
    • 1.1.38+ds1-1ubuntu0.1~esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Ubuntu:Pro:20.04:LTS

    Versions
    • 1.2.4+ds1-2ubuntu3
    • 1.2.9+ds1-1ubuntu1
    • 1.2.9+ds1-1ubuntu2
    • 1.2.10+ds1-1ubuntu1
    • 1.2.10+ds1-1ubuntu1+esm1
    • 1.2.10+ds1-1ubuntu1.1
    • 1.2.10+ds1-1ubuntu1.1+esm1
    • 1.2.10+ds1-1ubuntu1.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Ubuntu:Pro:22.04:LTS

    Versions
    • 1.2.16+ds1-2ubuntu1
    • 1.2.19+ds1-2ubuntu1
    • 1.2.19+ds1-2ubuntu1+esm1
    • 1.2.19+ds1-2ubuntu1.1
    • 1.2.19+ds1-2ubuntu1.1+esm1
    • 1.2.19+ds1-2ubuntu1.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Ubuntu:24.04:LTS

    Versions
    • 1.2.25+ds1-2
    • 1.2.26+ds1-1
    • 1.2.26+ds1-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Ubuntu:25.10

    Versions
    • 1.2.28+ds1-4ubuntu1
    • 1.2.30+ds1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Ubuntu:26.10

    Versions
    • 1.2.30+ds1-1ubuntu2
    • 1.2.30+ds1-1ubuntu3
    • 1.2.31+ds1-3ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cacti Ubuntu:26.04:LTS

    Versions
    • 1.2.30+ds1-1ubuntu1
    • 1.2.30+ds1-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →