Cacti: Input validation bypass in command blocklist (CVE-2026-39902)
Cacti versions prior to 1.2.31 contain an input validation bypass in the command blocklist, allowing an authenticated administrator to pass restricted characters.
CVE search metadata
CVE search record: CVE-2026-39902. Severity: high. CVSS: 7.2. KEV: no. Product: Cacti (< 1.2.31). Brief: Cacti: Input validation bypass in command blocklist (CVE-2026-39902). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cacti-command-injection/
Triage facts
Revision 1- Applicability
- Cacti (< 1.2.31)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 23, 15:43 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Cacti, an open source performance and fault management framework, contains an input validation bypass in versions prior to 1.2.31. The blocklist omitted single-quotes, double-quotes, redirect operators, subshell parentheses, and braces. An authenticated administrator could save an input_string containing single-quotes, redirect operators, or subshell parentheses, and pass the security check. This issue has been patched in version 1.2.31.