This vulnerability allows an attacker to read arbitrary files from the server’s filesystem. The flaw is a classic Path Traversal (CWE‑22) that occurs in two stages: first, the submitted format_file parameter is stored in the database without validation; second, the stored value is concatenated with a directory path and passed to a file reading function, enabling disclosure of any file accessible to the web process. Such access can expose confidential data and serve as a foothold for further attacks.

The flaw affects the Cacti performance and fault management framework. Versions 1.2.30 and earlier are vulnerable, with the issue remediated in 1.2.31. Any deployment running these versions, particularly in environments where users can create or modify report definitions, is at risk.

The CVSS score of 6.5 indicates a moderate severity, and no EPSS score is available. The attack requires crafting a payload and submitting it through the report interface, which means the attacker likely needs at least report‑authoring privileges. Once the first stage succeeds, the second stage permits reading any file visible to the web server process. The vulnerability is not listed in CISA’s KEV catalog.