CVE-2026-33739: FOG Stored XSS Vulnerability

CVE-2026-33739 Overview

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in FOG Project versions prior to 1.5.10.1812. The vulnerability exists in the listing tables on multiple management pages including Host, Storage, Group, Image, Printer, and Snapin. This security flaw stems from insufficient server-side parameter sanitization during record creations and updates, combined with a lack of HTML escaping in listing tables.

Critical Impact

Attackers with administrative access can inject malicious scripts that execute in the browsers of other users viewing affected management pages, potentially leading to session hijacking, credential theft, or unauthorized actions within the FOG management interface.

Affected Products

• FOG Project versions prior to 1.5.10.1812
• Host, Storage, Group, Image, Printer, and Snapin management pages

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33739 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33739

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability allows authenticated attackers to inject malicious JavaScript code through record creation and update operations on multiple FOG management pages. The injected script is stored in the database and executed whenever other users view the affected listing tables. The vulnerability affects critical management interfaces including Host, Storage, Group, Image, Printer, and Snapin pages, creating multiple attack surfaces within the application.

The root cause lies in the application's failure to properly sanitize user input on the server side before storing it, combined with inadequate HTML output encoding when rendering the data in listing tables. This dual failure enables persistent script injection attacks.

Root Cause

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). FOG Project fails to implement proper input validation and output encoding in two critical areas:

1. Server-side parameter sanitization - User-supplied data during record creation and updates is not properly sanitized before being stored in the database
2. HTML escaping in listing tables - When rendering stored data in management page tables, the application does not escape HTML entities, allowing stored scripts to execute

Attack Vector

The attack is network-based and requires the attacker to have authenticated access with privileges to create or update records (such as Host, Image, or Snapin entries). The attacker can inject malicious JavaScript payloads into fields that are displayed in listing tables. When another user, including administrators, navigates to the affected management pages, the stored malicious script executes in their browser context.

Typical attack scenarios include:

• Injecting script tags into naming fields or description fields of Host records
• Embedding malicious payloads in Image or Snapin metadata
• Using event handlers within crafted input to bypass basic filtering

The vulnerability manifests when unsanitized input is stored and later rendered without HTML encoding in the management interface listing tables. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33739

Indicators of Compromise

• Unusual JavaScript or HTML tags present in database records for Host, Storage, Group, Image, Printer, or Snapin tables
• Unexpected script execution or browser behavior when viewing FOG management pages
• Audit logs showing creation or modification of records with suspicious payload patterns (e.g., <script>, onerror=, onload=)

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS payloads in HTTP requests to FOG management endpoints
• Review database contents for stored records containing script tags, event handlers, or other potentially malicious HTML content
• Monitor browser console logs on client systems accessing FOG for unexpected script execution errors

Monitoring Recommendations

• Enable detailed logging for all record creation and update operations within FOG Project
• Deploy client-side Content Security Policy (CSP) headers to mitigate the impact of any successful XSS injection
• Conduct periodic security audits of stored data in affected tables to identify injected payloads

How to Mitigate CVE-2026-33739

Immediate Actions Required

• Upgrade FOG Project to version 1.5.10.1812 or later immediately
• Audit existing records in Host, Storage, Group, Image, Printer, and Snapin tables for potentially malicious content
• Review user accounts with record creation/update privileges and revoke unnecessary access
• Implement Content Security Policy (CSP) headers to reduce XSS impact

Patch Information

The FOG Project development team has addressed this vulnerability in version 1.5.10.1812. The patch implements proper server-side input sanitization for record creation and update operations, along with HTML escaping for data rendered in listing tables. Users should upgrade to this version or later to remediate the vulnerability. Additional details are available in the GitHub Security Advisory.

Workarounds

• Restrict access to FOG management pages to only trusted administrators until the patch can be applied
• Implement a reverse proxy with WAF capabilities to filter XSS payloads in incoming requests
• Manually sanitize existing database records by removing or encoding any HTML/script content in affected tables
• Deploy browser-based XSS protection mechanisms such as CSP headers with strict script-src directives

# Example CSP header configuration for Apache (temporary mitigation)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"