CVE-2026-47687: FOG Inventory System XSS Vulnerability

CVE-2026-47687 Overview

CVE-2026-47687 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in FOG, an open-source cloning, imaging, and inventory management suite. The selectForm() helper in fogpage.class.php renders <option> labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious sysproduct value to /service/inventory.php. The payload persists in the database and executes when an administrator opens Reports > Inventory in the FOG web console. Versions 1.5.10.1832 and 1.6.0-beta.2313 address the flaw.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in administrator browser sessions, enabling account takeover and further compromise of FOG-managed infrastructure.

Affected Products

FOG Project versions prior to 1.5.10.1832
FOG Project 1.6.0 beta versions prior to 1.6.0-beta.2313
FOG deployments exposing /service/inventory.php to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-47687 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47687

Vulnerability Analysis

The vulnerability resides in the selectForm() helper inside fogpage.class.php. This helper builds HTML <option> elements for the FOG administrative interface. It concatenates database-sourced values directly into the label without HTML entity encoding. Attacker-controlled values submitted through the inventory endpoint reach this sink unchanged.

The inventory intake endpoint /service/inventory.php accepts POST data from FOG client agents. It identifies hosts by MAC address and does not require session authentication. This design choice supports automated inventory collection from imaging clients, but it also exposes the write path to any attacker who can reach the endpoint and enumerate a valid MAC.

When an administrator navigates to Reports > Inventory, the FOG UI retrieves the stored sysproduct value and passes it to selectForm(). The unescaped payload breaks out of the <option> element and executes JavaScript in the administrator's authenticated context.

Root Cause

The root cause is missing output encoding in selectForm(). Values sourced from the inventory table are trusted as safe HTML rather than being escaped with htmlentities() or an equivalent encoder before insertion into the DOM.

Attack Vector

Exploitation requires network access to /service/inventory.php and knowledge of a registered host MAC address. The attacker submits a crafted sysproduct field containing an HTML break-out sequence followed by a <script> payload. The stored value fires the next time an administrator loads the Inventory report, satisfying the user interaction requirement in the CVSS vector.

The vulnerability is described in prose only. See the GitHub Security Advisory for full technical details and reproduction steps.

Detection Methods for CVE-2026-47687

Indicators of Compromise

POST requests to /service/inventory.php containing HTML tags, <script>, onerror=, or javascript: substrings in the sysproduct parameter.
Inventory database rows where sysproduct, sysmanufacturer, or related fields contain angle brackets or JavaScript event handlers.
Unexpected outbound requests from administrator browsers immediately after loading Reports > Inventory.

Detection Strategies

Inspect FOG web server access logs for POSTs to /service/inventory.php that include HTML metacharacters in body parameters.
Query the FOG hosts and inventory tables for rows containing <, >, or script in text columns typically limited to ASCII product identifiers.
Deploy Content Security Policy (CSP) reporting on the FOG admin interface to surface script executions from inline sources.

Monitoring Recommendations

Alert on administrator session cookie use from IP addresses that differ from the admin's normal workstation range.
Monitor for FOG API calls originating from browser sessions immediately after Inventory report views.
Track new host registrations and inventory updates for anomalous volume or malformed field content.

How to Mitigate CVE-2026-47687

Immediate Actions Required

Upgrade FOG to 1.5.10.1832 or 1.6.0-beta.2313 without delay.
Restrict network access to /service/inventory.php to trusted client subnets using firewall or reverse proxy rules.
Audit the inventory database for existing malicious payloads and sanitize or purge affected rows before administrators access the Inventory report.

Patch Information

The FOG maintainers released fixed versions 1.5.10.1832 and 1.6.0-beta.2313. The patch adds HTML entity encoding to the selectForm() helper in fogpage.class.php. Full details are available in the FOG Project GHSA-hg23-3w27-2rf2 advisory.

Workarounds

Block untrusted networks from reaching /service/inventory.php at the web server or firewall layer until the upgrade is applied.
Require administrators to avoid the Reports > Inventory page until the patch is deployed and stored payloads are removed.
Apply a temporary web application firewall rule that rejects POSTs to /service/inventory.php containing <, >, or script tokens.

bash

# Example nginx rule to block HTML metacharacters in inventory POSTs
location = /service/inventory.php {
    if ($request_method = POST) {
        if ($request_body ~* "(<|>|script|onerror=|javascript:)") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}