{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cacti--1.2.31/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-39902"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cacti (\u003c 1.2.31)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCacti, an open source performance and fault management framework, contains an input validation bypass in versions prior to 1.2.31. The blocklist omitted single-quotes, double-quotes, redirect operators, subshell parentheses, and braces. An authenticated administrator could save an input_string containing single-quotes, redirect operators, or subshell parentheses, and pass the security check. This issue has been patched in version 1.2.31.\u003c/p\u003e\n","date_modified":"2026-10-23T15:43:15Z","date_published":"2026-10-23T15:43:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cacti-command-injection/","summary":"Cacti versions prior to 1.2.31 contain an input validation bypass in the command blocklist, allowing an authenticated administrator to pass restricted characters.","title":"Cacti: Input validation bypass in command blocklist (CVE-2026-39902)","url":"https://feed.craftedsignal.io/briefs/2026-10-cacti-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cacti (\u003c 1.2.31)","version":"https://jsonfeed.org/version/1.1"}