CVE-2026-39955
Pre-authentication SQL injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
| CVE | CVE-2026-39955 |
|---|---|
| Status | PUBLISHED 2026-06-24 (GitHub CNA) |
| Product | Cacti |
| Affected | develop branch (1.3.0-dev) — verified at c869d9b2 / HEAD 2810342f65. Not in any stable release. |
| Not affected | 1.2.x stable and main (they use FILTER_VALIDATE_IS_NUMERIC_LIST) |
| Fixed | Unfixed on develop as of report; the regression is absent from the 1.2.x line |
| CWE | CWE-89 |
| CVSS 3.1 | 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/CACTI.md |
Detail
graph_template_id is validated with an unanchored FILTER_VALIDATE_REGEXP. An unanchored regex matches a substring, so a payload that merely contains a legal-looking numeric list passes and reaches the query intact. Sinks: lib/html_graph.php:255, duplicated at :1052. Time-based blind extraction works against an install with no rendered graphs.
Branch scope: this is a develop-branch regression only. The unanchored regex was introduced by the develop-branch refactor that replaced FILTER_VALIDATE_IS_NUMERIC_LIST with FILTER_VALIDATE_REGEXP; 1.2.x stable and main still use the numeric-list filter and are not affected. Confirmed against a develop (1.3.0-dev) checkout; a 1.2.x container is not exploitable.
Precondition: the guest account must be enabled. include/auth.php:133-150 holds the only pre-auth return true, and get_guest_account() returns 0 by default.
Remediation
See chains/CACTI.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/CACTI.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-39955.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch