What’s Vulnerable › Vulnerabilities
CVE-2026-33739: FOG has Stored XSS in Multiple Management Pages
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-27 · updated 2026-06-17
- Weakness: CWE-79
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1812, the listing tables on multiple management pages (Host, Storage, Group, Image, Printer, Snapin) are vulnerable to Stored Cross-Site Scripting (XSS), due to insufficient server-side parameter sanitization in record creations/updates and a lack of HTML escaping in listing tables. Version 1.5.10.1812 patches the issue.
Affected products
- fogproject: before 1.5.10.1812 — fixed in 1.5.10.1812
How to fix
Upgrade to a fixed version: fogproject 1.5.10.1812. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-33739 or the next vulnerability affects your stack