Input Validation Flaw in Cacti Performance Management Framework

CVE-2026-39902

What is CVE-2026-39902?

Cacti, an open source performance and fault management framework, experienced an input validation flaw prior to version 1.2.31. This vulnerability allowed authenticated administrators to save input strings containing potentially dangerous characters, such as single quotes and redirect operators, bypassing existing security checks. Malicious actors could exploit this oversight to manipulate the application's handling of inputs. The issue has been addressed in version 1.2.31, where the blocklist for input validation has been updated to include these critical characters, enhancing the overall security of the application.

References