Cacti is a complete web-based frontend to rrdtool.
It has been reported that the "local_graph_id" variable used in the file graph.php is not properly sanitized before being processed in an SQL statement.
A remote attacker could send a specially crafted request to the vulnerable host, possibly resulting in the execution of arbitrary SQL code.
There is no known workaround at this time.
All Cacti users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/cacti-0.8.6j-r7"