1. Home
  2. CVE Database
  3. CVE-2026-39938
CRITICAL · 9.8

CVE-2026-39938

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been ...

Vulnerability Description

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
CactiCacti< 1.2.31

Related Weaknesses (CWE)

CWE-78CWE-22

References

FAQ

What is CVE-2026-39938?

CVE-2026-39938 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been ...

How severe is CVE-2026-39938?

CVE-2026-39938 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-39938?

Check the references section above for vendor advisories and patch information. Affected products include: Cacti Cacti.