Path Traversal in Cacti Performance Management Framework by Cacti

CVE-2026-40084

What is CVE-2026-40084?

Cacti, an open-source performance and fault management framework, is susceptible to a Path Traversal vulnerability through the 'format_file' parameter in reports. This occurs in two phases: first, the software performs a stored injection where user-provided data is saved directly into the database without sufficient validation. In the subsequent phase, it reads arbitrary files from the filesystem by concatenating paths, allowing attackers to access sensitive information. This issue was addressed in version 1.2.31.

References