Medium severity · published Jul 21, 2026
CVE-2026-47689
FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab
5.2
CVSS
0.3%
EPSS
No
On KEV
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
fogproject · FOGProject
< 1.5.10.1832; < 1.6.0-beta.2313 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47689
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47689
Exploit
https://github.com/FOGProject/fogproject/security/advisories/GHSA-fqgf-j2gh-92cm
More from fogproject
9.8
CVE-2024-39914
FOG is a cloning/imaging/rescue suite/inventory management system
9.1
CVE-2025-58443
FOG's authentication bypass leads to full SQL DB dump
8.8
CVE-2026-116778
FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
8.8
CVE-2024-40645
FOG is a cloning/imaging/rescue suite/inventory management system
8.8
CVE-2021-32243
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated)