CVE-2023-49086 — Cacti is a robust performance and fault management framework and a frontend to R

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability

01What is this vulnerability?

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. The impact of the vulnerability…

02Affected products

Vendor	Product	Versions
Cacti	cacti	< 1.2.27

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

08Timeline

• Published: 2023-12-21T23:29:45.134Z
• Last modified: 2025-11-04T18:19:36.814Z

09References

• github.com — https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr
• github.com — https://github.com/Cacti/cacti/commit/6ec01c8b2983bf4fcb86f8c647655f74090b5be9
• lists.fedoraproject.org — https://lists.fedoraproject.org/archives/list/[email protected]…