CVE-2026-39948

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installations with guest graph viewing enabled. Because the unbalanced-quote payload bypasses the regex validation that would otherwise reject it, an unauthenticated attacker can inject arbitrary SQL to compromise the confidentiality, integrity, and availability of the database. This advisory is similar to GHSA-69gg-mjfm-jjpc. This issue has been fixed in version 1.2.31.

• CWE-89

• https://github.com/Cacti/cacti/commit/136ae6ef0715e77bca69c0eb60781f5e17df0795Patch
• https://github.com/Cacti/cacti/security/advisories/GHSA-9jqv-4cpm-vm2cPatch, Vendor Advisory

Published

Jun 24, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3994A vulnerability was detected in rui314 mold up to 2.40.4. Th…5.3
• CVE-2026-39940ChurchCRM is an open-source church management system. Prior …5.3
• CVE-2026-39941ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39942Directus is a real-time API and App dashboard for managing S…8.8
• CVE-2026-39943Directus is a real-time API and App dashboard for managing S…6.5
• CVE-2026-39946OpenBao is an open source identity-based secrets management …4.9
• CVE-2026-3995The OPEN-BRAIN plugin for WordPress is vulnerable to Stored …4.4
• CVE-2026-39951Cacti is an open source performance and fault management fra…8.8
• CVE-2026-39955Cacti is an open source performance and fault management fra…9.8
• CVE-2026-39956jq is a command-line JSON processor. In commits after 69785b…6.1
• CVE-2026-39957Lychee is a free, open-source photo-management tool. Prior t…4.3
• CVE-2026-39958oma is a package manager for AOSC OS. Prior to 1.25.2, oma-t…9.1