CVE-2026-39938

Executive Summary

CVE-2026-39938 is a critical unauthenticated Local File Inclusion (LFI) vulnerability in Cacti, an open-source performance and fault management framework. Versions 1.2.30 and prior are affected. The vulnerability allows an unauthenticated attacker to read arbitrary files on the server by exploiting insecure handling of the graph_theme parameter and weaknesses in rrdtool IPC serialization. This can lead to full system compromise, including exposure of sensitive configuration files, credentials, and potential remote code execution if combined with other techniques. The CVSS score is 9.8 (Critical). No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk is severe due to the unauthenticated nature of the attack.

Supply Chain & Package Security

Cacti is a PHP-based application distributed via GitHub and package managers. The vulnerability is in the core application code, not in a third-party package. However, organizations using Cacti should verify the integrity of their installation and ensure no malicious modifications have been made. The patch is available in version 1.2.31.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is trivially exploitable over the network without authentication, making it a top priority for patching.

Deep Dive & Mechanics

The vulnerability resides in the way Cacti handles the graph_theme parameter in certain HTTP requests. An attacker can supply a path traversal sequence (e.g., ../../../../etc/passwd) to include arbitrary files from the server's filesystem. Additionally, the rrdtool IPC serialization mechanism is not properly hardened, allowing an attacker to manipulate serialized data to trigger file inclusion.

The core issue is that user-supplied input is not sanitized before being used in file inclusion functions. The graph_theme parameter is passed to a function that constructs a file path without proper validation, leading to LFI.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2.30):

// In graph.php or similar
$theme = $_GET['graph_theme'];
include("themes/" . $theme . "/header.php");

Patched Code (version 1.2.31):

// In graph.php or similar
$theme = basename($_GET['graph_theme']);
$allowed_themes = ['classic', 'modern', 'dark'];
if (in_array($theme, $allowed_themes)) {
    include("themes/" . $theme . "/header.php");
} else {
    // Handle error
}

The patch uses basename() to strip directory traversal sequences and validates the input against a whitelist of allowed themes.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Cacti 1.2.30 on a vulnerable server (e.g., Ubuntu 22.04 with Apache and PHP).
2. Ensure the server is accessible from the attacker's machine.

Exploitation Steps:

1. Send a crafted HTTP GET request to the vulnerable endpoint:

   GET /graph.php?graph_theme=../../../../etc/passwd%00 HTTP/1.1
   Host: target.com
   

2. The null byte (%00) may be used to terminate the string, but modern PHP versions may not be vulnerable to null byte injection. Instead, use path traversal:

   GET /graph.php?graph_theme=../../../../etc/passwd HTTP/1.1
   

3. The server will include the /etc/passwd file in the response.

Advanced Exploitation:

• Use PHP wrappers like php://filter to read source code:

  GET /graph.php?graph_theme=php://filter/convert.base64-encode/resource=config.php HTTP/1.1
  

• Attempt to achieve Remote Code Execution (RCE) by writing a malicious PHP file via log poisoning or other techniques.

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious graph_theme parameters containing ../, ..\\, or PHP wrappers.
2. Deploy WAF rules to block path traversal patterns.
3. Use file integrity monitoring to detect unauthorized file modifications.

Hunting Queries:

• Search for HTTP requests with graph_theme containing ../ or php://.
• Look for outbound connections from the Cacti server to unknown IPs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with graph_theme=../../ or similar patterns.
  • Requests to /graph.php with unusual parameters.
• File System IOCs:
  • Unexpected files in /tmp/ or web-accessible directories.
  • Modified Cacti configuration files.
• Log IOCs:
  • Apache/Nginx access logs showing path traversal attempts.
  • PHP error logs indicating failed file inclusions.

Detection Engineering

YARA Rule

rule CVE_2026_39938_LFI_Attempt {
    meta:
        description = "Detects path traversal attempts targeting Cacti graph_theme parameter"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-39938"
    strings:
        $s1 = "graph_theme" nocase
        $s2 = "../" nocase
        $s3 = "..\\" nocase
        $s4 = "php://" nocase
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: Cacti LFI via graph_theme Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Cacti graph_theme parameter
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'graph_theme=../'
            - 'graph_theme=..\\'
            - 'graph_theme=php://'
    condition: selection
falsepositives:
    - Legitimate use of themes with similar names (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-39938 Cacti LFI Attempt"; flow:to_server,established; content:"graph_theme"; http_uri; content:"../"; distance:0; within:100; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Cacti to version 1.2.31 or later.
2. Workaround: If immediate patching is not possible, restrict access to the Cacti web interface using firewall rules or VPN.
3. WAF Rules: Deploy web application firewall rules to block path traversal patterns in the graph_theme parameter.
4. File Permissions: Ensure that sensitive files (e.g., /etc/passwd, configuration files) are not readable by the web server user.
5. Monitoring: Enable detailed logging and monitor for suspicious activity.
6. Backup: Maintain regular backups of the Cacti installation and database.

Valters IT
DevSecOps & Cyber Threat Intelligence