CVE-2026-40079
CVE-2026-40079 · Cacti: Command Injection via escape_command() no-op in RRDtool execution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandline). The risk is in __rrd_execute() where text_format values from graph templates (which may contain host variable substitutions) reach shell_exec without adequate escaping. This issue has been addressed in version 1.2.31.
CVSS 8.6 · High · EPSS 1.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
cacti
- Versions
- < 1.2.31: Affected
No fix published
cacti Debian:12
- Versions
- 1.2.24+ds1-1
- 1.2.24+ds1-1+deb12u1
- 1.2.24+ds1-1+deb12u2
- 1.2.24+ds1-1+deb12u3
- 1.2.24+ds1-1+deb12u4
- 1.2.24+ds1-1+deb12u5
- 1.2.25+ds1-1
- 1.2.25+ds1-2
- 1.2.26+ds1-1
- 1.2.27+ds1-1
- 1.2.27+ds1-2
- 1.2.28+ds1-1
- 1.2.28+ds1-2
- 1.2.28+ds1-3
- 1.2.28+ds1-4
- 1.2.30+ds1-1
- 1.2.30+ds1-2
- 1.2.30+ds1-3
- 1.2.31+ds1-1
- 1.2.31+ds1-2
- 1.2.31+ds1-3
- 1.2.31+ds1-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Debian:13
- Versions
- 1.2.30+ds1-1
- 1.2.30+ds1-2
- 1.2.30+ds1-3
- 1.2.31+ds1-1
- 1.2.31+ds1-2
- 1.2.31+ds1-3
- 1.2.31+ds1-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Debian:14
- Versions
- 1.2.30+ds1-1
- 1.2.30+ds1-2
- 1.2.30+ds1-3
- Affected ranges
- ECOSYSTEM: < 1.2.31+ds1-1
Update to 1.2.31+ds1-1
cacti Ubuntu:Pro:14.04:LTS
- Versions
- 0.8.8b+dfsg-3
- 0.8.8b+dfsg-5
- 0.8.8b+dfsg-5ubuntu0.1
- 0.8.8b+dfsg-5ubuntu0.2
- 0.8.8b+dfsg-5ubuntu0.2+esm1
- 0.8.8b+dfsg-5ubuntu0.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:Pro:16.04:LTS
- Versions
- 0.8.8f+ds1-2
- 0.8.8f+ds1-3
- 0.8.8f+ds1-4
- 0.8.8f+ds1-4ubuntu1
- 0.8.8f+ds1-4ubuntu2
- 0.8.8f+ds1-4ubuntu3
- 0.8.8f+ds1-4ubuntu4
- 0.8.8f+ds1-4ubuntu4.16.04
- 0.8.8f+ds1-4ubuntu4.16.04.1
- 0.8.8f+ds1-4ubuntu4.16.04.2
- 0.8.8f+ds1-4ubuntu4.16.04.2+esm1
- 0.8.8f+ds1-4ubuntu4.16.04.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:Pro:18.04:LTS
- Versions
- 1.1.18+ds1-1
- 1.1.27+ds1-2
- 1.1.27+ds1-3
- 1.1.28+ds1-2
- 1.1.35+ds1-1
- 1.1.36+ds1-1
- 1.1.38+ds1-1
- 1.1.38+ds1-1ubuntu0.1~esm1
- 1.1.38+ds1-1ubuntu0.1~esm3
- 1.1.38+ds1-1ubuntu0.1~esm4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:Pro:20.04:LTS
- Versions
- 1.2.4+ds1-2ubuntu3
- 1.2.9+ds1-1ubuntu1
- 1.2.9+ds1-1ubuntu2
- 1.2.10+ds1-1ubuntu1
- 1.2.10+ds1-1ubuntu1+esm1
- 1.2.10+ds1-1ubuntu1.1
- 1.2.10+ds1-1ubuntu1.1+esm1
- 1.2.10+ds1-1ubuntu1.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:Pro:22.04:LTS
- Versions
- 1.2.16+ds1-2ubuntu1
- 1.2.19+ds1-2ubuntu1
- 1.2.19+ds1-2ubuntu1+esm1
- 1.2.19+ds1-2ubuntu1.1
- 1.2.19+ds1-2ubuntu1.1+esm1
- 1.2.19+ds1-2ubuntu1.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:24.04:LTS
- Versions
- 1.2.25+ds1-2
- 1.2.26+ds1-1
- 1.2.26+ds1-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:25.10
- Versions
- 1.2.28+ds1-4ubuntu1
- 1.2.30+ds1-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:26.10
- Versions
- 1.2.30+ds1-1ubuntu2
- 1.2.30+ds1-1ubuntu3
- 1.2.31+ds1-3ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:26.04:LTS
- Versions
- 1.2.30+ds1-1ubuntu1
- 1.2.30+ds1-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published