CVE-2026-47687 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint
Unauthenticated attackers can inject JavaScript via inventory data, leading to arbitrary code execution in admin browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-47687?
CVE-2026-47687 is a high-severity cross-site scripting vulnerability in fogproject, published on 21 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<option>` element and executes arbitrary JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-47687?
It affects 1 product.
Products include Fogproject Fogproject.
How do I fix CVE-2026-47687?
No fix has been published for CVE-2026-47687 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-47687 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47687 exists.
Other vulnerabilities in fogproject
- CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump
- CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=
- CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)
- CVE-2024-40645 FOG Authenticated File Upload RCE
- CVE-2021-32243 File upload in n/a