CVE-2026-47685 FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

What is CVE-2026-47685?

CVE-2026-47685 is a high-severity cross-site scripting vulnerability in fogproject, published on 21 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that executes in any administrator's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

Weakness: CWE-79

Which versions are affected by CVE-2026-47685?

It affects 1 product.

Products include Fogproject Fogproject.

How do I fix CVE-2026-47685?

No fix has been published for CVE-2026-47685 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-47685 being exploited?

There is no known exploitation of CVE-2026-47685 in the wild and no public exploit code.

Other vulnerabilities in fogproject

• CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump Critical 9.9
• CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename= Critical 9.8
• CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password) Critical 9.3
• CVE-2024-40645 FOG Authenticated File Upload RCE High 8.8
• CVE-2021-32243 File upload in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• How this page is made