CVE-2026-40079

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandline). The risk is in __rrd_execute() where text_format values from graph templates (which may contain host variable substitutions) reach shell_exec without adequate escaping. This issue has been addressed in version 1.2.31.

• CWE-78
• CWE-88

• https://github.com/Cacti/cacti/commit/4c09efaebf3a9faec66969d0b5c4aceaf397f37fPatch
• https://github.com/Cacti/cacti/security/advisories/GHSA-xq98-376r-hv9jMitigation, Patch, Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40072web3.py allows you to interact with the Ethereum blockchain …7.2
• CVE-2026-40073SvelteKit is a framework for rapidly developing robust, perf…7.5
• CVE-2026-40074SvelteKit is a framework for rapidly developing robust, perf…7.5
• CVE-2026-40075OpenMRS Core is an open source electronic medical record sys…7.5
• CVE-2026-40076OpenMRS Core is an open source electronic medical record sys…8.8
• CVE-2026-40077Beszel is a server monitoring platform. Prior to 0.18.7, som…3.1
• CVE-2026-4008A flaw has been found in Tenda W3 1.0.0.3(2204). This issue …8.8
• CVE-2026-40080Cacti is an open source performance and fault management fra…6.1
• CVE-2026-40082Cacti is an open source performance and fault management fra…5.4
• CVE-2026-40083Cacti is an open source performance and fault management fra…7.2
• CVE-2026-40084Cacti is an open source performance and fault management fra…6.5
• CVE-2026-40086Rembg is a tool to remove images background. Prior to 2.0.75…5.3