Locale-sensitive decimal formatting in the rrdtool_function_update() of Cacti versions 1.2.30 and earlier can corrupt RRDtool metric values. The function checks values with is_numeric() and then interpolates them into the RRDtool update command. PHP casts floating numbers according to the LC_NUMERIC locale; when the locale uses a comma as the decimal separator (for example, de_DE), a value of 1.5 becomes the string "1,5". RRDtool expects a dot as the decimal separator, so the metric data may be shifted into wrong columns or silently dropped. This defect results in data integrity problems but is not remotely exploitable and requires a server configured with a non-standard LC_NUMERIC locale. The weakness is represented by CWE‑474.

Affected products include the Cacti performance and fault management framework. Versions 1.2.30 and earlier are vulnerable; the issue was fixed in Cacti 1.2.31.

The CVSS score is 2.9, indicating low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the bug only manifests when the server locale is configured to use a comma decimal separator, the attack vector is local system configuration rather than remote exploitation. The risk is primarily a data integrity concern for monitoring dashboards and historical data analysis.