CVE-2026-47685

Received Received - Intake

Stored XSS in FOG Project Inventory Service

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that executes in any administrator's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47685

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in FOG, an open-source imaging system. An unauthenticated endpoint (/service/inventory.php) saves user-supplied data without sanitization. The Host Management Inventory page then renders this data into HTML without proper encoding, enabling malicious scripts to execute in the browsers of administrators who view the page.

Detection Guidance

Check if your FOG server version is below 1.5.10.1832 or 1.6.0-beta.2313. Inspect network traffic for requests to /service/inventory.php with unsanitized input. Review server logs for unusual HTML content in inventory fields.

Impact Analysis

An attacker could exploit this to steal session cookies, perform actions as an admin, or redirect users to malicious sites. Since it targets administrators, the impact includes potential full system compromise, data theft, or unauthorized modifications to FOG's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using FOG may face compliance violations if exploited.

Mitigation Strategies

Upgrade FOG to version 1.5.10.1832 or 1.6.0-beta.2313 or later. If immediate upgrade is not possible, restrict access to the /service/inventory.php endpoint and review all inventory fields for malicious HTML content.

Hi! I’m here to help you understand CVE-2026-47685. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70