CVE-2026-39899: Cacti Path Traversal Information Disclosure Vulnerability

Technical summary

CVE-2026-39899 is a path traversal vulnerability (CWE-22) in Cacti's package_import.php file. The vulnerability stems from insufficient validation of the filename parameter, allowing an unauthenticated remote attacker to traverse the filesystem and read files outside the intended import directory. The CVSS 3.1 score of 5.3 reflects the network-accessible attack vector and low complexity, but limited to confidentiality impact with no integrity or availability compromise. The vulnerability affects Cacti version 1.2.30 and prior releases.

Business impact

Organizations running Cacti for infrastructure monitoring and fault management face potential information disclosure. An attacker exploiting this vulnerability could read sensitive files such as database credentials, configuration files containing API keys, or monitoring data that might reveal infrastructure details. While not allowing system compromise or service disruption, the data exposure could facilitate further attacks or regulatory compliance violations if protected information is accessed. Organizations relying on Cacti for critical monitoring should prioritize patching to maintain data confidentiality.

Affected systems

The vulnerability affects Cacti version 1.2.30 and all prior releases. Cacti is commonly deployed in enterprise environments for network performance monitoring, graphing, and reporting. Both on-premise and cloud-hosted Cacti installations are at risk if not updated. The open source nature of Cacti means affected instances span diverse environments; organizations should audit their deployments to identify all Cacti installations in use.

Exploitability

The vulnerability is exploitable with minimal complexity. No authentication is required, and the attack can be executed over the network by sending a specially crafted request to the package_import.php endpoint with a malicious filename parameter. The straightforward nature of path traversal exploitation and the lack of authentication requirements make this vulnerability relatively easy to exploit, though the impact is confined to unauthorized file reading. The attack does not require user interaction or specialized privileges.

Remediation

Upgrade Cacti to version 1.2.31 or later, which includes the security fix for the filename parameter validation in package_import.php. Organizations should verify compatibility with their environment and test the upgrade in a non-production setting before deploying to production systems. Additionally, network-level controls such as limiting access to the Cacti web interface to trusted networks can reduce exposure while upgrades are planned or staged.

Patch guidance

Cacti version 1.2.31 addresses the vulnerability and should be applied as soon as feasible. Verify the upgrade path from your current version to 1.2.31 using the official Cacti release notes and upgrade documentation. After patching, verify that the package_import.php functionality operates correctly and that monitoring data collection resumes without issues. For environments where immediate patching is not possible, implement network segmentation or access controls to restrict external access to the Cacti interface.

Detection guidance

Monitor web server logs for requests to package_import.php that contain path traversal sequences such as '../' or encoded variants (%2e%2e%2f). Unusual filename parameters referencing files outside typical import directories (such as requests targeting /etc/, /opt/, or other sensitive paths) may indicate exploitation attempts. Web application firewalls (WAF) can be configured to block requests with path traversal patterns before reaching the application. Enable detailed logging on the Cacti instance to capture attempted exploitation for forensic review.

Why prioritize this

While the CVSS score of 5.3 is moderate, the lack of authentication requirement, network accessibility, and potential for exposing sensitive configuration data warrant timely patching. Organizations should prioritize this as part of routine security maintenance. The vulnerability is not currently listed on the CISA KEV catalog, indicating lower active exploitation in the wild, but the straightforward attack vector means exploitation could begin at any time. Plan patching around normal maintenance windows rather than as an emergency response.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a Medium severity vulnerability. The score is driven by network accessibility (AV:N), low attack complexity (AC:L), and no privilege or user interaction requirements (PR:N/UI:N). The impact is limited to confidentiality (C:L), with no integrity or availability compromise (I:N/A:N). The scope is unchanged (S:U). This baseline assessment assumes a standard Cacti deployment; organizations with highly sensitive data monitored by Cacti or Cacti interfaces exposed to untrusted networks may warrant treating this as higher priority in their risk framework.

Frequently asked questions