{"schema":"threatline.record/2","record":{"id":"CVE-2026-39902","aliases":["GHSA-c4qp-j9r9-fq24"],"summary":"Cacti: Authenticated RCE on Data Input","details":"Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\\\n\\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string` containing single-quote, redirect operator, or subshell parens, and pass the check. This issue has been patched in version 1.2.31.","categories":["Applications & CMS"],"product":"cacti","vendor":"Cacti","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-39902","source_modified_at":"2026-10-23T14:42:45.710Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"cacti","vendor":"Cacti","versions":[{"status":"affected","version":"< 1.2.31"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00572,"percentile":0.46633,"score_date":"2026-10-24"},"published_at":"2026-10-23T14:42:45.710Z","modified_at":"2026-10-23T14:42:45.710Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-39902","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T14:42:45.710Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-39902","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/Cacti/cacti/pull/7112","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T14:42:45.710Z","content_hash":"80bf6ef70a97c0f3d8501625d96e0d741c13d2296dc044faa9947b0ef4947b95"}}