CVE-2026-47685: FOG Cloning System Stored XSS Vulnerability

CVE-2026-47685 Overview

CVE-2026-47685 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in FOG, a free open-source cloning, imaging, rescue, and inventory management suite. The unauthenticated inventory service endpoint /service/inventory.php persists client-supplied values without sanitization. The Host Management Inventory page then renders these static inventory fields into HTML without output encoding. Any administrator viewing the affected host triggers execution of attacker-controlled JavaScript. FOG versions prior to 1.5.10.1832 and 1.6.0-beta.2313 are affected. The maintainers released fixes in versions 1.5.10.1832 and 1.6.0-beta.2313.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in administrator browsers, enabling session theft, privileged action forgery, and full FOG server compromise through the administrator context.

Affected Products

FOG Project versions prior to 1.5.10.1832
FOG Project 1.6.0 beta versions prior to 1.6.0-beta.2313
FOG inventory service endpoint /service/inventory.php

Discovery Timeline

2026-07-21 - CVE-2026-47685 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47685

Vulnerability Analysis

The vulnerability is a stored XSS flaw rooted in two independent failures. First, the inventory intake endpoint accepts unauthenticated POST data from any network client. Second, the administrative rendering page trusts persisted values as safe HTML. Together they form a classic write-once, execute-many attack pattern.

The attack vector is network-based with low complexity. An attacker only needs to reach the FOG server's inventory endpoint. No authentication is required to poison the inventory database. Exploitation completes when a privileged administrator loads the Host Management Inventory page. The result is script execution under the administrator's session, granting the attacker high impact on confidentiality and integrity of the FOG deployment.

Root Cause

The root cause is missing input sanitization at ingest and missing output encoding at render. The endpoint /service/inventory.php persists client-supplied fields verbatim into inventory records. The Host Management Inventory view then interpolates those fields directly into HTML without applying context-aware escaping such as htmlspecialchars(). Standard defenses like allowlist validation, encoding at output, or a Content Security Policy are absent from the vulnerable versions.

Attack Vector

An unauthenticated attacker sends a crafted request to /service/inventory.php containing malicious payloads in inventory fields such as system manufacturer, model, or serial number. FOG stores these values against a host record. When an administrator navigates to the affected host's inventory page, the browser parses the injected <script> payload and executes it in the FOG administrative origin. The attacker can exfiltrate session cookies, submit authenticated administrative requests, deploy hostile imaging tasks, or pivot into managed endpoints during imaging operations.

No verified public exploit code is available. Technical details are documented in the FOG Project GitHub Security Advisory.

Detection Methods for CVE-2026-47685

Indicators of Compromise

POST requests to /service/inventory.php originating from unexpected or external IP addresses.
Inventory field values containing HTML tags, <script> markers, javascript: URIs, or event handler attributes such as onerror= and onload=.
Unexpected outbound HTTP requests from administrator browsers immediately after viewing Host Management Inventory pages.
New or modified FOG administrative accounts, imaging tasks, or scheduled deployments created without operator activity.

Detection Strategies

Inspect the FOG database hosts and inventory tables for stored values containing HTML metacharacters like <, >, or " in fields that should be plain text.
Enable HTTP access logging on the FOG web server and alert on unauthenticated POSTs to /service/inventory.php from non-imaging subnets.
Deploy a web application firewall rule that inspects request bodies to /service/inventory.php for common XSS token sequences.

Monitoring Recommendations

Correlate administrator authentication events with subsequent anomalous FOG API calls to identify session hijacking behavior.
Monitor administrator browser telemetry for script execution originating from the FOG origin that reaches out to unknown domains.
Retain FOG web and database logs for at least 90 days to support retrospective hunting once patches are applied.

How to Mitigate CVE-2026-47685

Immediate Actions Required

Upgrade FOG to version 1.5.10.1832 on the stable branch or 1.6.0-beta.2313 on the beta branch without delay.
Restrict network access to /service/inventory.php to trusted imaging VLANs using firewall or reverse proxy rules.
Audit stored inventory records and purge any entries containing HTML or script content before administrators reopen affected host pages.
Rotate FOG administrator credentials and invalidate active administrative sessions after remediation.

Patch Information

The FOG Project addressed CVE-2026-47685 in versions 1.5.10.1832 and 1.6.0-beta.2313. The fixes add input handling and output encoding on the inventory ingest and rendering paths. Patch details and upgrade guidance are published in the FOG Project GitHub Security Advisory GHSA-2r7m-6mqf-5cc4.

Workarounds

Block external access to /service/inventory.php at the reverse proxy until patching completes.
Enforce a strict Content Security Policy on the FOG web interface that disallows inline scripts to reduce XSS execution impact.
Instruct administrators to avoid opening Host Management Inventory pages for untrusted or externally reachable hosts until the upgrade is applied.

bash

# Example nginx snippet to block external access to the vulnerable endpoint
location = /service/inventory.php {
    allow 10.0.0.0/8;      # trusted imaging subnet
    allow 192.168.0.0/16;  # trusted management subnet
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}