CVE-2026-40084 Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter
Attackers can read arbitrary files from the server via path traversal in the report format_file parameter, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40084?
CVE-2026-40084 is a medium-severity path traversal vulnerability in Cacti Cacti, published on 25 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/html_reports.php at line 283 stores $save['format_file'] = $post['format_file'] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTI_PATH_FORMATS . '/' . $format_file, and line 670 then calls file($format_file), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.
Weakness: CWE-22
Which versions are affected by CVE-2026-40084?
It affects 1 product.
Products include Cacti Cacti.
How do I fix CVE-2026-40084?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40084 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40084 exists.
Other vulnerabilities in Cacti Cacti
- CVE-2022-46169 Cacti Command Injection
- CVE-2026-39893 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
- CVE-2026-39938 Cacti: Unauthenticated RCE on Graph Image
- CVE-2026-39955 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
- CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti
Sources
Also known as DEBIAN-CVE-2026-40084, GHSA-mjvw-mhj5-9jcj, UBUNTU-CVE-2026-40084.