CVE-2026-39893CWE-89

Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php

Critical · published June 24, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports guest access via the configured guest user), so the SQLi was reachable pre-auth on installs with guest viewing enabled. This issue was fixed in version 1.2.31.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00674 · 51.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-06-24T21:45Z
EPSS history
Timeline
  • 24 JUN 21:45Z
    Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
    cvelistv5