What’s Vulnerable › Vulnerabilities

CVE-2026-47687: FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

• Severity: high (CVSS 8.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-21 · updated 2026-08-07
• Weakness: CWE-79

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<option>` element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

Affected products

• fogproject: before 1.5.10.1832 — fixed in 1.5.10.1832

How to fix

Upgrade to a fixed version: fogproject 1.5.10.1832. Check the vendor advisory for mitigations.

References

• https://github.com/FOGProject/fogproject/security/advisories/GHSA-hg23-3w27-2rf2
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-hg23-3w27-2rf2

Get alerted when CVE-2026-47687 or the next vulnerability affects your stack