Cacti versions earlier than 1.2.31 contain a missing validation filter that allows authenticated administrators to submit input strings with shell metacharacters such as single quotes, redirection operators, or subshell parentheses. When these characters are stored, they can later be executed by the underlying system shell, giving an attacker the ability to run arbitrary commands with the privileges of the web server process. This attack results in complete compromise of the host where Cacti is running, including confidentiality, integrity, and availability loss. The weakness falls under CWE‑78, a classic command injection flaw.

The affected product is the Cacti performance management platform. All releases prior to version 1.2.31 are vulnerable because the input filtering blocklist omitted critical shell metacharacters. Administrators of any Cacti installation using these earlier releases can exploit the flaw by logging in with administrative credentials and saving a malicious input string. The latest release, 1.2.31 and later, implements the missing validation and is therefore not affected.

The CVSS score of 7.2 indicates moderate to high severity, while the lack of an EPSS score means exploit prevalence was not quantified at the time. The flaw is not listed in CISA's KEV catalog. Exploitation requires authenticated access to Cacti's administrative interface; an attacker with such privileges can trigger the injection immediately. Based on the description, it is inferred that admin accounts may be shared or located on an exposed network, which could increase the risk of compromise, especially in environments lacking strict role-based access control.