CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump
Unauthenticated attackers can bypass authentication to dump the full SQL database in FOG Project imaging servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-58443?
CVE-2025-58443 is a critical authentication bypass vulnerability in fogproject, published on 6 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure. See the FOG Project documentation for step-by-step upgrade instructions: https://docs.fogproject.org/en/latest/install-fog-server#choosing-a-fog-version.
Which versions are affected by CVE-2025-58443?
It affects 1 product.
Products include Fogproject Fogproject.
How do I fix CVE-2025-58443?
No fix has been published for CVE-2025-58443 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-58443 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58443 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in fogproject
- CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=
- CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)
- CVE-2024-40645 FOG Authenticated File Upload RCE
- CVE-2021-32243 File upload in n/a
- CVE-2023-46236 FOG SSRF via unauthenticated endpoint(s)
Sources
Also known as GHSA-mvwm-9m2h-87p9.