CVE-2026-39939
Path traversal in package import permits arbitrary file write
| CVE | CVE-2026-39939 |
|---|---|
| Status | RESERVED (GHSA-vp35-4h28-r883) |
| Product | Cacti |
| Affected | all branches |
| Fixed | see note |
| CWE | CWE-22, CWE-434 |
| CVSS 3.1 | 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/CACTI.md |
Detail
The import writer tests that a member filename contains scripts/. str_contains is a containment test, so scripts/../shell.php passes; there is no realpath() containment and no ../ rejection, and attacker-controlled content reaches fwrite() at the resolved path.
Reach: this sink requires an authenticated user holding the Import Templates realm (PR:L). It becomes pre-authentication only when chained behind CVE-2026-39955 + CVE-2026-40941, which are develop-branch only — so the pre-auth RCE chain is a develop (1.3.0-dev) finding, not a stable-release one.
Correction to the vendor's changelog: Cacti's shipped CHANGELOG lists this as fixed in 1.2.31. The fix commit 36fa99bda is dated 61 days after 1.2.31 shipped. Verify you are on a build containing that commit, not on the changelog.
Remediation
See chains/CACTI.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/CACTI.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-39939.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch