CVE-2026-47689 FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab
An unauthenticated attacker can inject malicious scripts via inventory data, leading to admin session hijacking or code execution when viewed in the Group Inventory tab.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-47689?
CVE-2026-47689 is a medium-severity cross-site scripting vulnerability in fogproject, published on 21 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-47689?
It affects 1 product.
Products include Fogproject Fogproject.
How do I fix CVE-2026-47689?
No fix has been published for CVE-2026-47689 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-47689 being exploited?
There is no known exploitation of CVE-2026-47689 in the wild and no public exploit code.
Other vulnerabilities in fogproject
- CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump
- CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=
- CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)
- CVE-2024-40645 FOG Authenticated File Upload RCE
- CVE-2021-32243 File upload in n/a