CVE-2020-8813

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via...

8.8 HighPublic exploitFix available

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

74.0%Up 57.9 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Record: CVE-2020-8813
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Record: CVE-2020-8813
Updated: 2026-11-02

EUVDEUVD-2020-29661 No score

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Record: EUVD-2020-29661
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gg99-fwr4-rcj9 8.8

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via...

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Record: GHSA-gg99-fwr4-rcj9
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSVALPINE-CVE-2020-8813 8.8

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Record: ALPINE-CVE-2020-8813
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV 8.8

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Record: CVE-2020-8813
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVDEBIAN-CVE-2020-8813 8.8

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Record: DEBIAN-CVE-2020-8813
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-8813 8.8

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

Record: UBUNTU-CVE-2020-8813
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0558-1 No score

Security update for cacti, cacti-spine

This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:

This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.

Record: openSUSE-SU-2020:0558-1
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0565-1 No score

Security update for cacti, cacti-spine

This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:

This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record: openSUSE-SU-2020:0565-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10670-1 No score

cacti-1.2.18-1.2 on GA media

These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10670-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cacti` Alpine:v3.11	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.12	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.13	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.14	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.15	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.16	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.17	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.18	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.19	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.20	before 1.2.8-r0	1.2.8-r0

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`cacti` Alpine:v3.21	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.22	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.23	before 1.2.8-r0	1.2.8-r0
`cacti` Alpine:v3.24	before 1.2.8-r0	1.2.8-r0
`cacti` Debian:12	before 1.2.10+ds1-1	1.2.10+ds1-1
`cacti` Debian:13	before 1.2.10+ds1-1	1.2.10+ds1-1
`cacti` Debian:14	before 1.2.10+ds1-1	1.2.10+ds1-1
`cacti` Debian:10	before 1.2.2+ds1-2+deb10u5, plus listed versions 1.2.2+ds1-21.2.2+ds1-2+deb10u11.2.2+ds1-2+deb10u21.2.2+ds1-2+deb10u31.2.2+ds1-2+deb10u4	1.2.2+ds1-2+deb10u5
`cacti` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.10.8.8b+dfsg-5ubuntu0.20.8.8b+dfsg-5ubuntu0.2+esm10.8.8b+dfsg-5ubuntu0.2+esm2	None known
`cacti` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.1.18+ds1-11.1.27+ds1-21.1.27+ds1-31.1.28+ds1-21.1.35+ds1-1 Show 5 moreShow less 1.1.36+ds1-11.1.38+ds1-11.1.38+ds1-1ubuntu0.1~esm11.1.38+ds1-1ubuntu0.1~esm31.1.38+ds1-1ubuntu0.1~esm4	None known
`cacti` SUSE:Package Hub 12	before 1.2.11-5.1	1.2.11-5.1
`cacti-spine` SUSE:Package Hub 12	before 1.2.11-2.1	1.2.11-2.1
`cacti` openSUSE:Leap 15.1	before 1.2.11-5.1	1.2.11-5.1
`cacti-spine` openSUSE:Leap 15.1	before 1.2.11-2.1	1.2.11-2.1
`cacti` SUSE:Package Hub 15 SP1	before 1.2.11-bp151.4.6.1	1.2.11-bp151.4.6.1
`cacti-spine` SUSE:Package Hub 15 SP1	before 1.2.11-bp151.4.6.1	1.2.11-bp151.4.6.1
`cacti` openSUSE:Tumbleweed	before 1.2.18-1.2	1.2.18-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Cacti 1.2.8 - Authenticated Remote Code Execution	2020-02-03
Exploit-DB	Cacti 1.2.8 - Unauthenticated Remote Code Execution	2020-02-03
PoC in GitHub	mhaskar/CVE-2020-8813	2020-02-22
PoC in GitHub	0xm4ud/Cacti-CVE-2020-8813	2021-05-11
PoC in GitHub	hexcowboy/CVE-2020-8813	2021-05-28
PoC in GitHub	p0dalirius/CVE-2020-8813-Cacti-RCE-in-graph_realtime	2022-09-30
Nuclei	Cacti v1.2.8 - Remote Code Execution

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	exploits
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8813 is a high vulnerability (CVSS 8.8) in Cacti, published February 22, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.0%, the 99th percentile. Fixed in cacti 1.2.8-r0.

References

Show 64 moreShow less