CVE-2026-39951

NameCVE-2026-39951
DescriptionCacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1140813

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cacti (PTS)bookworm, bookworm (security)1.2.24+ds1-1+deb12u5vulnerable
trixie1.2.30+ds1-1vulnerable
forky, sid1.2.31+ds1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cactisource(unstable)1.2.31+ds1-11140813

Notes

https://github.com/Cacti/cacti/security/advisories/GHSA-pf37-v86f-5xwp
Fixed by: https://github.com/Cacti/cacti/commit/4c09efaebf3a9faec66969d0b5c4aceaf397f37f (release/1.2.31)
Search for package or bug name: Reporting problems