What’s Vulnerable › Vulnerabilities

CVE-2023-46237: FOG path traversal via unauthenticated endpoint

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-31 · updated 2026-06-17
• Weakness: CWE-22

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.

Affected products

• fogproject: before 1.5.10 — fixed in 1.5.10

How to fix

Upgrade to a fixed version: fogproject 1.5.10. Check the vendor advisory for mitigations.

References

• https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2
• https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2

Get alerted when CVE-2023-46237 or the next vulnerability affects your stack