CVE-2026-40079

CriticalCVSS 9.8/10Last modified Jun 26, 2026

Description

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandline). The risk is in __rrd_execute() where text_format values from graph templates (which may contain host variable substitutions) reach shell_exec without adequate escaping. This issue has been addressed in version 1.2.31.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-88

Affected software

Vendor	Product	Versions
Cacti	cacti	< 1.2.31

References

https://github.com/Cacti/cacti/commit/4c09efaebf3a9faec66969d0b5c4aceaf397f37fPatch
https://github.com/Cacti/cacti/security/advisories/GHSA-xq98-376r-hv9jMitigation, Patch, Vendor Advisory

Timeline

Published: Jun 25, 2026
Last modified: Jun 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-40088.8A flaw has been found in Tenda W3 1.0.0.3(2204). This issue affects some unknown processing of the file /goform/wifiSSIDset of the component CVE-2026-400806.1Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a subs CVE-2026-400825.4Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after log CVE-2026-400837.2Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unseria CVE-2026-400846.5Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the CVE-2026-400865.3Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated CVE-2026-400875.3LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template CVE-2026-400889.6PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-con CVE-2026-400899.9Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a S CVE-2026-40093.3A vulnerability has been found in jarikomppa soloud up to 20200207. Impacted is the function drwav_read_pcm_frames_s16__msadpcm in the libra CVE-2026-400907.1Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in th CVE-2026-400914.4SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.