{"id":"CVE-2026-39902","kind":"vulnerability","aliases":["CVE-2026-39902"],"related":[],"title":"Cacti: weak input blocklist lets admins run shell commands","description":"Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.","summary":"Cacti, an open source network monitoring framework, filters input with a blocklist that misses quotes, redirects and subshell characters. An authenticated admin can save a crafted input string that gets past the filter and runs shell commands on the server.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cacti","package","php","self-hosted"],"not_affected_if":["auth-required","patched-version"],"how_to_check":"- Run `php -r 'echo CACTI_VERSION;'` or check the version shown in the Cacti web footer and confirm it is below `1.2.31`\n- Check the Cacti install for the input_string handling in the data input configuration if the version is unclear","fix":"- Upgrade Cacti to `1.2.31` or later\n- Until upgraded, limit admin accounts to trusted staff","status":"open","published_at":"2026-10-23T15:17:30+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:27:38+00:00","updated_at":"2026-10-25T03:27:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:27:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cacti to `1.2.31` or later\n- Until upgraded, limit admin accounts to trusted staff","reach":"internet","title":"Cacti: weak input blocklist lets admins run shell commands","impact":"high","summary":"Cacti, an open source network monitoring framework, filters input with a blocklist that misses quotes, redirects and subshell characters. An authenticated admin can save a crafted input string that gets past the filter and runs shell commands on the server.","category":"package","nicknames":[],"who_cares":["cacti","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Admin attacker runs arbitrary shell commands on the Cacti server","analyst_note":"","how_to_check":"- Run `php -r 'echo CACTI_VERSION;'` or check the version shown in the Cacti web footer and confirm it is below `1.2.31`\n- Check the Cacti install for the input_string handling in the data input configuration if the version is unclear","needs_analyst":false,"not_affected_if":["auth-required","patched-version"],"who_is_affected":"Any Cacti install running a version before `1.2.31` is exposed, since the flaw is in the core input validation. Exposure requires an account with administrator rights, so teams that already restrict admin access have less risk. Installs already on `1.2.31` or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00059,"input_tokens":3329,"output_tokens":514,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-39902':12A,15A '1.2.31':75C,122C 'admin':6A,43B,96C 'authent':42B,95C 'blocklist':4A,33B,78C 'brace':93C 'cacti':1A,16B,22B,62C 'charact':40B 'check':114C 'command':9A,58B 'contain':102C 'could':97C 'craft':47B 'cve':10A,13A 'doubl':86C 'double-quot':85C 'fault':69C 'filter':29B,54B 'framework':28B,71C 'get':51B 'host':21B 'input':3A,30B,48B,100C 'issu':116C 'let':5A 'manag':70C 'miss':35B 'monitor':27B 'n':79C 'network':26B 'omit':81C 'open':24B,65C 'oper':89C,107C 'packag':17B 'paren':91C,110C 'pass':112C 'past':52B 'patch':119C 'perform':67C 'php':18B 'prior':72C,77C 'quot':36B,84C,87C,105C 'r':80C 'redirect':37B,88C,106C 'run':7A,56B 'save':45B,98C 'self':20B 'self-host':19B 'server':61B 'shell':8A,57B 'singl':83C,104C 'single-quot':82C,103C 'sourc':25B,66C 'string':49B,101C 'subshel':39B,90C,109C 'version':74C,121C 'weak':2A","nicknames":[],"mitigations":[],"who_affected":"Any Cacti install running a version before `1.2.31` is exposed, since the flaw is in the core input validation. Exposure requires an account with administrator rights, so teams that already restrict admin access have less risk. Installs already on `1.2.31` or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39902","severity":null,"published_at":"2026-10-23T15:17:30+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}