CVE-2026-47685 in Fogproject
Summary
by MITRE • 07/22/2026
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that executes in any administrator's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The FOG Project represents a comprehensive open-source solution for network-based computer imaging, cloning, and inventory management systems widely deployed in enterprise environments. This vulnerability affects versions prior to 1.5.10.1832 and 1.6.0-beta.2313 where the inventory service endpoint lacks proper input validation mechanisms. The flaw manifests in the `/service/inventory.php` component which accepts client-supplied data without adequate sanitization procedures, creating a persistent security weakness that can be exploited by unauthorized actors.
The technical implementation of this vulnerability stems from inadequate data validation and output encoding practices within the Host Management Inventory page functionality. When inventory data is submitted through the unauthenticated endpoint, the system stores these values directly without proper sanitization measures that would normally filter or escape potentially malicious content. Subsequently, when administrators access the inventory management interface, all static inventory fields are rendered into HTML without appropriate output encoding, creating a classic stored cross-site scripting vulnerability.
This vulnerability operates under the CWE-79 classification as a Stored Cross-Site Scripting flaw, where malicious scripts are permanently stored on the server and executed in the context of other users' browsers. The operational impact is significant since administrators who view the inventory data become victims of the stored XSS attack, potentially allowing attackers to execute arbitrary JavaScript code within their browser sessions. This could enable session hijacking, credential theft, or further exploitation of the administrative privileges available through the FOG management interface.
The attack vector leverages the unauthenticated nature of the inventory service endpoint, meaning that any remote attacker can submit malicious payloads without requiring prior authentication. The vulnerability is particularly dangerous in enterprise environments where FOG systems manage critical infrastructure and inventory data, as successful exploitation could provide attackers with access to sensitive information and administrative capabilities. This aligns with ATT&CK technique T1566.001 for initial access through spearphishing attachments and T1071.004 for application layer protocol usage.
The remediation implemented in versions 1.5.10.1832 and 1.6.0-beta.2313 addresses the core issue by introducing proper input sanitization mechanisms within the inventory service endpoint and implementing appropriate output encoding when rendering inventory data into HTML. This fix ensures that client-supplied values are validated against expected formats and that any potentially malicious content is properly escaped before being rendered in the browser context. Organizations should immediately upgrade to these patched versions to eliminate the stored XSS vulnerability and protect their FOG deployments from potential exploitation attempts.
The vulnerability highlights critical security principles around input validation and output encoding that align with OWASP Top Ten categories A03: Injection and A05: Security Misconfiguration. The lack of proper data sanitization in the inventory service endpoint represents a failure to implement defense-in-depth measures that should be standard practice in web applications handling user-supplied content. This incident underscores the importance of comprehensive security testing including both dynamic and static analysis of open-source software components before deployment in production environments, particularly those handling sensitive enterprise inventory data.