CVE-2026-46531
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column, which is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the "Apply Automation Rules" bulk action. The injected SELECT result is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channel.
Risk Assessment
A user with Automation privileges can execute arbitrary SQL in the database context and exfiltrate data through the tree UI. Affected versions are 1.2.27 through before 1.2.31.
Recommendation
Upgrade Cacti to version 1.2.31 or later. Restrict Automation role privileges to trusted administrators only.
Other vulnerabilities in Cacti
See all- CVE-2016-10700High
In auth_login.php in Cacti before 1.0.0, remote authenticated users can bypass intended access restrictions by logging in as a user not in the Cacti database, because the guest user is not considered.
- CVE-2014-4000High
Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
- CVE-2017-16660High
Cacti version 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root and then making a remote_agent.php request containing PHP code in a Client-ip header.
- CVE-2017-16641High
In Cacti 1.1.27, the lib/rrd.php file allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.
- CVE-2017-1000031High
CVE-2017-1000031 is an SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b that allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.
- CVE-2016-2313High
The auth_login.php file in Cacti before version 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the Cacti database.
- CVE-2016-3659High
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.
- CVE-2015-4454High
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before version 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.
- CVE-2015-4342High
SQL injection vulnerability in Cacti before version 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
- CVE-2014-2709High
The lib/rrd.php file in Cacti versions 0.8.7g, 0.8.8b, and earlier contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.
Original NVD description (English source)
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 ("Apply Automation Rules") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS