Dashboard / CVE-2026-39902

CVE-2026-39902

HIGH 1 PoC
MEDIUM Priority: 0.03 BB Relevance: 69/100
Published: 2026-10-23 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Cacti cacti < 1.2.31

References & Advisories (2)

Proof of Concept (1)

—
https://github.com/kx00007/CVE-2026-39902
nomi-sec

Bug Bounty Relevance

69 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

7.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.40%
Raw Score 0.004030
Percentile 34.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00403
2026-10-28
0.00403

Intelligence Sources

mitre ref →
nvd ref →

External Links