This vulnerability in Cacti (≤ 1.2.30) involves improper sanitization of user-controlled host metadata fields (notably the device notes) that are substituted into RRDtool command-line arguments without escaping. The variable substitution engine replaces tokens like |host_notes| with raw database values and passes them to the shell, enabling command injection. An attacker with authenticated access and graph management privileges can inject shell metacharacters into the notes field, create a graph template referencing |host_notes|, and trigger arbitrary command execution on the server when the graph is rendered. The vulnerability is traced through host.php (device save handler), lib/variables.php (substitution engine), and lib/rrd.php (RRDtool invocation). A proof-of-concept exploit automates these steps.

Successful exploitation allows an authenticated user with device and graph template creation privileges to execute arbitrary commands on the underlying server with the web server user's privileges. This can lead to full remote code execution, potentially compromising the server hosting Cacti. The vulnerability requires authenticated access and specific permissions, limiting exposure to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Cacti changelog link suggests a fix may exist in development branches, but no official patch release is confirmed in the provided data. Until an official fix is available, restrict graph management privileges to trusted users only and monitor for updates from the Cacti project. Avoid using untrusted input in host metadata fields that are referenced in graph templates.