Executive Summary

CVE-2026-40079 is a command injection vulnerability in the Cacti software, specifically in the way it executes RRDtool commands. The root cause is the escape_command() function in lib/rrd.php, which is supposed to sanitize commands but instead returns them unchanged, allowing potentially malicious input to reach the shell_exec() function without proper escaping.

This vulnerability occurs when graph templates contain text format values with host variable substitutions that are passed through escape_command() and then executed by shell_exec(), enabling an attacker to inject arbitrary OS commands.

The issue affects Cacti versions 1.2.30 and earlier and has been fixed in version 1.2.31 by properly sanitizing or removing the vulnerable function and ensuring all command arguments are escaped.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with access to graph templates or host variable inputs to execute arbitrary operating system commands on the server running Cacti.

Such command injection can lead to unauthorized access, data compromise, system disruption, or complete takeover of the affected system.

Because the vulnerability is exploitable remotely (network attack vector) and has a high severity score (CVSS 8.6), it poses a significant risk to the confidentiality, integrity, and availability of the system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the vulnerable Cacti versions (1.2.30 and prior) are in use and if unescaped user-controlled input is reaching shell_exec() via the escape_command() function in lib/rrd.php.

Specifically, monitoring or auditing the command lines built by rrdtool_function_graph() for unescaped host variable substitutions can help detect exploitation attempts.

While no explicit commands are provided in the resources, general detection steps could include:

• Checking the Cacti version installed to confirm if it is 1.2.30 or earlier.
• Reviewing logs for unusual shell_exec() calls or command executions originating from Cacti processes.
• Using system monitoring tools to detect unexpected command executions or network activity related to rrdtool invocations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Cacti to version 1.2.31 or later, where the vulnerability has been addressed.

If upgrading is not immediately possible, consider the following:

• Replace or remove the no-op escape_command() function to ensure proper sanitization of commands.
• Audit all values flowing into the command line to ensure they are properly escaped or sanitized.
• Consider modifying the code to use a pipe path (fwrite) instead of shell invocation to avoid command injection risks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Cacti allows command injection due to improper sanitization of inputs passed to shell commands. This can lead to unauthorized command execution on the affected system.

Such a vulnerability can impact compliance with standards like GDPR and HIPAA because it may lead to unauthorized access or manipulation of sensitive data, violating data protection and privacy requirements.

Mitigations such as proper input sanitization, patching to version 1.2.31, and auditing command line inputs are necessary to reduce the risk and help maintain compliance with these regulations.

Useful 0 Not Useful 0