{"id":"CVE-2026-39902","title":"Cacti: Authenticated RCE on Data Input","summary":"Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin c…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-78"],"vendor":"Cacti","product":"cacti","affected":["cacti < 1.2.31"],"exploitAvailable":true,"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T14:42:45.710Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-39902","references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24","label":"https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24"},{"url":"https://github.com/Cacti/cacti/pull/7112","label":"https://github.com/Cacti/cacti/pull/7112"}],"tags":["cve.org","exploit-available"],"exploits":{"github":1,"githubRepos":["https://github.com/kx00007/CVE-2026-39902"],"checkedAt":"2026-10-23T15:30:10.899Z"},"ingestedAt":"2026-10-23T15:29:36.882Z","slug":"CVE-2026-39902","body":"## Overview\n\nCacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.\n\n## Affected\n\n- `cacti < 1.2.31`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}