CVE-2026-47687 in Fogproject
Summary
by MITRE • 07/22/2026
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<option>` element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The FOG Project represents a comprehensive open-source solution for system imaging, cloning, and inventory management within enterprise environments. This software serves as a critical infrastructure component for IT departments managing large fleets of computers through centralized deployment and monitoring capabilities. The vulnerability discovered affects versions prior to 1.5.10.1832 and 1.6.0-beta.2313, specifically targeting the `selectForm()` helper function within the `fogpage.class.php` file. This flaw represents a classic cross-site scripting vulnerability that exploits improper input sanitization in the rendering process of HTML form elements.
The technical implementation of this vulnerability stems from the insecure handling of user-supplied data within the web application's output generation mechanism. When the system processes inventory data, particularly the `sysproduct` parameter submitted through POST requests to `/service/inventory.php`, it fails to properly escape or sanitize the input before incorporating it into HTML markup. The specific flaw occurs when the `selectForm()` helper function renders `<label>` elements, where raw user input flows directly into the HTML structure without appropriate encoding or validation measures.
This vulnerability operates under the premise that an attacker can leverage knowledge of a registered host's MAC address to craft malicious payloads. The attack vector requires only basic network access and knowledge of existing system identifiers to construct a targeted payload that exploits the lack of input validation. When an administrator subsequently navigates to Reports > Inventory, the stored malicious data is rendered in the browser context, triggering the execution of arbitrary JavaScript code within the administrative session.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with potential access to privileged administrative functions within the FOG environment. The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws in web applications where untrusted data is incorporated into HTML output without proper sanitization. From an attack framework perspective, this vulnerability maps to ATT&CK technique T1059.007 for scripting and T1566 for credential harvesting through malicious web content.
The security implications are particularly concerning given that FOG systems typically manage sensitive inventory data and deployment configurations across multiple networked devices. An attacker could potentially execute malicious code within the context of an administrator's browser session, potentially leading to privilege escalation, data exfiltration, or further compromise of the underlying infrastructure. The vulnerability affects both the 1.5.x and 1.6.x release branches, indicating a persistent flaw in input handling practices that required specific version updates to address.
Mitigation strategies should focus on implementing proper input validation and output encoding mechanisms throughout the application's data processing pipeline. Organizations using FOG systems must immediately upgrade to versions 1.5.10.1832 or 1.6.0-beta.2313 where the vulnerability has been patched. Additionally, network segmentation and access controls should be implemented to limit exposure of the inventory service endpoints to untrusted networks. Regular security auditing of web application code should include thorough review of HTML output generation processes to prevent similar vulnerabilities from emerging in other components of the system.