Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/html_reports.php at line 283 stores $save['format_file'] = $post['format_file'] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTI_PATH_FORMATS . '/' . $format_file, and line 670 then calls file($format_file), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40084 Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Paramet… https://www.cve.org/CVERecord?id=CVE-2026-40084
Post summary
The post references CVE-2026-40084, which is a Path Traversal vulnerability in Cacti versions 1.2.30 and earlier, but provides no PoC, exploit, or patch details.
CVE-2026-40084 Path Traversal in Cacti 1.2.30 and Prior via Report Format_file Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40084
Post summary
CVE-2026-40084 is a path traversal vulnerability affecting Cacti 1.2.30 and earlier via the Report Format_file parameter; no PoC, exploit code, active exploitation, or patch information is mentioned.
🚨*CVE* CVE-2026-40084 Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Paramet… https://www.cve.org/CVERecord?id=CVE-2026-40084 ----- Traducción: CVE-2026-40084 Cac… http://infoflow.cloud`
Post summary
The post announces CVE-2026-40084, noting it affects Cacti versions 1.2.30 and earlier due to a path traversal flaw in the Report format_file parameter.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cacti | cacti | - | - | - |