CVE-2026-47689
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
FOG prior to versions 1.5.10.1832 and 1.6.0-beta.2313 contains an HTML/JavaScript injection vulnerability. An unauthenticated attacker knowing a host's MAC address can POST malicious inventory values to /service/inventory.php, which are stored in the database. When an admin opens the Group Inventory tab, the payload executes in the admin's browser.
Risk Assessment
An attacker could hijack an admin session, steal data, or spread malware within the network.
Recommendation
Update FOG to version 1.5.10.1832 or 1.6.0-beta.2313 (or later).
Other vulnerabilities in FOG
See all- CVE-2025-58443Critical
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025.
- CVE-2026-116778High
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 holding both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API does not enforce an administrator-only role. With storage replication enabled, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing command execution as root.
- CVE-2026-54554High
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php returned the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and could be dispatched through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.
- CVE-2026-47688High
Vulnerability in FOG (imaging/inventory management system). An unauthenticated attacker can remotely wipe AES keys and delete power management tasks via a single HTTP GET request.
- CVE-2026-47687High
XSS vulnerability in FOG (open-source cloning/imaging tool) allows an unauthenticated attacker who knows a host's MAC address to inject malicious JavaScript via the sysproduct parameter. The payload executes in the admin's browser when viewing inventory reports.
- CVE-2026-47685High
Vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders static inventory fields without output encoding, allowing stored XSS in any administrator's browser.
Original NVD description (English source)
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS