CVE-2026-40084: Cacti Path Traversal in Report Format Parameter – File Disclosure Vulnerability

Technical summary

The vulnerability manifests through a two-stage attack chain. First, the application stores untrusted input from the 'format_file' POST parameter directly into the database via lib/html_reports.php without sanitization or validation. Second, during report generation, lib/reports.php retrieves this stored value and constructs a file path by concatenating CACTI_PATH_FORMATS with the user-controlled filename, then passes it to PHP's file() function. This concatenation fails to prevent path traversal sequences (e.g., '../../../etc/passwd'), allowing reads beyond the intended formats directory. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Business impact

Successful exploitation enables unauthorized disclosure of sensitive files hosted on the Cacti server, including configuration files containing database credentials, API keys, or other system secrets. In monitored environments, this could expose credentials for connected network devices or monitoring targets. The impact is limited to information disclosure—attackers cannot modify or delete data—but the confidentiality breach may violate compliance requirements (HIPAA, PCI-DSS, SOC 2) depending on what files are accessible and what data resides on the server.

Affected systems

Cacti versions 1.2.30 and prior are affected. The vulnerability requires valid authentication credentials, so it impacts organizations running Cacti with multiple user accounts or externally accessible instances. Patched version 1.2.31 and later remove the vulnerability.

Exploitability

Exploitation requires valid Cacti user credentials (PR:L in CVSS), making this a lateral-movement or insider-threat vector rather than an unauthenticated attack. Once authenticated, an attacker can trivially craft a malicious format_file parameter via the report interface. No special network conditions or user interaction are required; the attack is deterministic. CVSS 3.1 score of 6.5 (MEDIUM) reflects the authentication barrier and pure confidentiality impact. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Cacti to version 1.2.31 or later. Organizations unable to patch immediately should restrict network access to the Cacti web interface (firewall rules, VPN requirement) and audit user account permissions to minimize the number of authenticated users who can access the report generation functionality.

Patch guidance

Apply the upgrade to Cacti 1.2.31 as soon as feasible. Verify the upgrade through the Cacti release notes and your vendor advisory to confirm the specific patch addressing CVE-2026-40084. Test the upgrade in a non-production environment first, particularly if you have custom report formats or integrations that depend on the report module.

Detection guidance

Monitor for suspicious access to report generation features, particularly repeated attempts with unusual format_file parameter values containing path traversal sequences (../, ..\, or percent-encoded variants). Web application firewalls or reverse proxies can block requests with '../' or similar patterns in the format_file parameter. Baseline normal report usage and flag deviations. Review Cacti logs for report generation requests from unexpected user accounts or at unusual times. File integrity monitoring on sensitive system files (e.g., /etc/passwd, configuration files) may detect unauthorized reads, though most web servers will not log successful file() calls at the application layer without additional instrumentation.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized for organizations with sensitive data on or accessible from the Cacti server, or for instances with untrusted or numerous user accounts. If your Cacti deployment is internal-only, air-gapped, or has strictly controlled user access, risk is lower. However, the ease of exploitation once authenticated and the potential for credential disclosure warrant timely patching across most deployments.

Risk score, explained

CVSS 3.1 score of 6.5 reflects a network-accessible service (AV:N) with low attack complexity (AC:L), but the requirement for valid credentials (PR:L) prevents higher scores. The impact is confidentiality-only (C:H/I:N/A:N)—no integrity or availability loss. The scope is unchanged (S:U). Organizations with higher trust boundaries around their Cacti users or air-gapped systems may consider actual risk lower; those with permissive user provisioning or internet-facing Cacti should treat it as closer to HIGH priority.

Frequently asked questions