CVE-2026-40084: Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter

Vulnerability summary

CVE-2026-40084 is a medium (CVSS 6.5) vulnerability in cacti. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-06-2026
   PublishedVulnerability first disclosed.
2. 26-06-2026
   Last modifiedVulnerability information updated.

Description

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/html_reports.php at line 283 stores $save['format_file'] = $post['format_file'] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTI_PATH_FORMATS . '/' . $format_file, and line 670 then calls file($format_file), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.