CVE-2026-40084

Executive Summary

CVE-2026-40084 is a Path Traversal vulnerability in Cacti, an open-source performance and fault management framework. Versions 1.2.30 and prior are affected. The vulnerability allows an authenticated attacker with report management privileges to read arbitrary files from the server's filesystem. The attack is executed in two stages: first, a stored injection via the format_file parameter in lib/html_reports.php stores an attacker-controlled path into the database without validation. Second, in lib/reports.php, this stored path is concatenated with a base directory and passed to the file() function, leading to arbitrary file read. The vulnerability has been fixed in version 1.2.31.

Supply Chain & Package Security

This vulnerability is in the core Cacti application, not in a package manager ecosystem. However, organizations using Cacti should verify the integrity of their installation and ensure they are not running a modified or backdoored version. The official source for Cacti is the GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with report management access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the requirement for authentication and the limitation to file read (no write or RCE). However, the ability to read sensitive files like /etc/passwd, database configuration files, or application secrets makes this a significant risk.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw. It occurs in two distinct stages:

1. Stored Injection (lib/html_reports.php, line 283): When a user creates or edits a report, the format_file parameter from the POST request is stored directly into the database without any sanitization or validation. The code $save['format_file'] = $post['format_file']; blindly trusts user input.

2. File Read (lib/reports.php, lines 667-670): When the report is generated or viewed, the stored format_file value is retrieved from the database. The code then concatenates it with a base path: CACTI_PATH_FORMATS . '/' . $format_file. The CACTI_PATH_FORMATS constant typically points to a directory like /var/www/html/cacti/formats/. The attacker can use path traversal sequences (e.g., ../../../../etc/passwd) to escape this directory. The resulting path is then passed to the file() function, which reads the file's contents into an array. This array is then used to generate the report output, exposing the file's contents to the attacker.

The vulnerability is exploitable because:

• No input validation on the format_file parameter during storage.
• No path normalization or restriction on the file() function call.
• The attacker can control the path after the base directory.

Vulnerable vs. Patched Code

Vulnerable Code (Cacti <= 1.2.30):

In lib/html_reports.php (line 283):

$save['format_file'] = $post['format_file'];

In lib/reports.php (lines 667-670):

$format_file = $report['format_file'];
$file = CACTI_PATH_FORMATS . '/' . $format_file;
if (file_exists($file)) {
    $data = file($file);
}

Patched Code (Cacti >= 1.2.31):

The fix likely involves validating the format_file input to ensure it is a legitimate filename within the allowed directory. A common approach is to use basename() to strip path components, or to check that the resolved path starts with the expected base directory.

Example patch (conceptual):

// In lib/html_reports.php
$save['format_file'] = basename($post['format_file']); // Strip path traversal

// Or in lib/reports.php
$format_file = $report['format_file'];
$file = realpath(CACTI_PATH_FORMATS . '/' . $format_file);
if (strpos($file, realpath(CACTI_PATH_FORMATS)) === 0 && file_exists($file)) {
    $data = file($file);
}

The official fix is included in version 1.2.31.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Cacti instance running version 1.2.30 or earlier.
• Valid credentials for a user with "Report Management" privileges (e.g., admin).

Exploitation Steps:

1. Login: Authenticate to the Cacti web interface.
2. Create a Malicious Report:
   • Navigate to "Reports" -> "Add".
   • Fill in the required fields (e.g., Report Name).
   • In the "Format File" field, enter a path traversal payload to read a sensitive file. For example:

     ../../../../etc/passwd
     

   • Save the report.
3. Trigger the File Read:
   • Navigate to the list of reports and click on the report you just created.
   • The report generation process will read the file specified in the format_file field.
   • The contents of /etc/passwd will be displayed in the report output.

Example Payloads:

• Read Apache configuration: ../../../../etc/apache2/apache2.conf
• Read Cacti database config: ../../../../var/www/html/cacti/include/config.php
• Read system logs: ../../../../var/log/syslog

Blue Team

Detection:

• Monitor web server logs for requests to lib/reports.php with unusual format_file parameters containing ../ sequences.
• Monitor database queries for INSERT or UPDATE statements on the reports table where format_file contains path traversal characters.
• Use file integrity monitoring (FIM) to detect when sensitive files are read by the web server process.

Hunting:

• Search for reports with format_file values that do not match expected patterns (e.g., only .txt or .html files in the formats directory).
• Review Cacti logs for errors related to file access outside the expected formats directory.

Mitigation:

• Apply the patch by upgrading to Cacti 1.2.31 immediately.
• If immediate patching is not possible, restrict access to the report management functionality to only trusted administrators.
• Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the format_file parameter.
• Use a reverse proxy to validate and sanitize input before it reaches the Cacti application.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /cacti/lib/html_reports.php with a format_file parameter containing ../ sequences.
  • HTTP GET requests to /cacti/lib/reports.php with a id parameter referencing a report with a malicious format_file.
• File System:
  • Unexpected files in the Cacti formats directory (though the vulnerability reads files outside this directory).
  • Access to sensitive files (e.g., /etc/passwd, /etc/shadow, database configs) by the web server user.
• Database:
  • Rows in the reports table where the format_file column contains path traversal sequences (e.g., ../../).
• Logs:
  • Web server access logs showing requests to lib/reports.php with unusual parameters.
  • Cacti application logs showing errors related to file access.

Detection Engineering

YARA Rule

rule CVE_2026_40084_Cacti_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Cacti format_file parameter"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-40084"
        severity = "high"
    strings:
        $s1 = "format_file" nocase
        $s2 = "../" nocase
        $s3 = "..\\" nocase
        $s4 = "/etc/" nocase
        $s5 = "/var/" nocase
    condition:
        all of ($s1, $s2) or all of ($s1, $s3) or all of ($s1, $s4) or all of ($s1, $s5)
}

Sigma Rule

title: Cacti Path Traversal via format_file Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Cacti's format_file parameter
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40084
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'format_file'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-40084 Cacti Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"format_file"; http_client_body; content:"../"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Cacti to version 1.2.31 or later. This is the only complete fix.
2. Workaround (if patching is delayed):
   • Restrict access to the report management functionality to only trusted administrators.
   • Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the format_file parameter.
   • Use a reverse proxy to validate and sanitize input before it reaches the Cacti application.
3. Long-term:
   • Implement input validation for all user-supplied data, especially file paths.
   • Use a whitelist of allowed filenames or directories instead of a blacklist.
   • Apply the principle of least privilege to the web server user.
   • Regularly update Cacti and all dependencies.

Valters IT