Cacti, the performance and fault management platform, suffers from an unauthenticated local file inclusion flaw that can be abused to execute arbitrary code. The vulnerability stems from the graph_theme parameter and rrdtool inter-process communication serialization hardening across versions 1.2.30 and earlier. Through this flaw an attacker can read sensitive files, inject code, and ultimately gain full control over the affected server, compromising confidentiality, integrity, and availability of all hosted services.

The affected product is the open‑source Cacti system. Versions through 1.2.30, inclusive, are vulnerable; the issue was addressed in version 1.2.31. Any deployment of Cacti within this version range is at risk, regardless of environment, as the flaw does not require any privileged user or additional software.

The CVSS score of 9.8 categorizes this as Critical, reflecting the ease of exploitation and severe impact. EPSS information is unavailable, so the likelihood of active exploitation is uncertain but cannot be discounted. The vulnerability is not listed in the CISA KEV catalog, yet its high severity and unauthenticated nature suggest it may be actively targeted by threat actors. The likely attack path involves sending a crafted request to the graph image rendering endpoint, using a malicious graph_theme value, thereby triggering the LFI and gaining execution on the server.