Server file disclosure via package diff traversal

Path traversal in Cacti before 1.2.31 allows remote authenticated users to read server files through the package import diff view. The package_diff_file() handler passes the unfiltered filename request value into file_get_contents() beneath the application base path without canonicalizing it or rejecting parent-directory segments. The endpoint loads Cacti authentication and realm checks, and disclosure requires package-import access plus staged package data with a matching filename; the demonstrated consequence is file reading, not modification or service interruption.