CVE-2026-47689
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
FOG prior to versions 1.5.10.1832 and 1.6.0-beta.2313 contains an HTML/JavaScript injection vulnerability. An unauthenticated attacker knowing a host's MAC address can POST malicious inventory values to /service/inventory.php, which are stored in the database. When an admin opens the Group Inventory tab, the payload executes in the admin's browser.
Risk Assessment
An attacker could hijack an admin session, steal data, or spread malware within the network.
Recommendation
Update FOG to version 1.5.10.1832 or 1.6.0-beta.2313 (or later).
Other vulnerabilities in FOG
See all- CVE-2026-47688High
Vulnerability in FOG (imaging/inventory management system). An unauthenticated attacker can remotely wipe AES keys and delete power management tasks via a single HTTP GET request.
- CVE-2026-47687High
XSS vulnerability in FOG (open-source cloning/imaging tool) allows an unauthenticated attacker who knows a host's MAC address to inject malicious JavaScript via the sysproduct parameter. The payload executes in the admin's browser when viewing inventory reports.
- CVE-2026-47685High
Vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders static inventory fields without output encoding, allowing stored XSS in any administrator's browser.
Original NVD description (English source)
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.