CVE-2026-47689: FOG Cloning Suite XSS Vulnerability

CVE-2026-47689 Overview

CVE-2026-47689 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in FOG, an open-source cloning, imaging, rescue, and inventory management suite. The buildRow() method in fogpage.class.php uses str_replace() to insert data into HTML table templates without HTML escaping. An unauthenticated attacker on an adjacent network who knows a registered host's MAC address can POST malicious inventory values to /service/inventory.php. The payload persists in the database and executes in an administrator's browser when the Group Inventory tab is opened. Versions 1.5.10.1832 and 1.6.0-beta.2313 remediate the issue.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes with administrator session context, enabling account takeover and further compromise of the FOG management console.

Affected Products

FOG Project versions prior to 1.5.10.1832 (1.5.x branch)
FOG Project versions prior to 1.6.0-beta.2313 (1.6.x beta branch)
Deployments exposing /service/inventory.php to any reachable host on the local network

Discovery Timeline

2026-07-21 - CVE-2026-47689 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47689

Vulnerability Analysis

The vulnerability is a stored XSS in FOG's inventory intake pipeline. The /service/inventory.php endpoint accepts inventory reporting from client hosts identified by MAC address. It stores fields such as sysproduct, sysserial, and other system identifiers in the database without sanitizing HTML metacharacters.

When an administrator later loads the Group Inventory tab, the buildRow() method in fogpage.class.php uses str_replace() to substitute stored values into HTML <td> cell templates. Because str_replace() performs a raw string substitution and no output escaping is applied, any HTML or JavaScript in the stored fields renders as executable markup in the administrator's session.

Exploitation requires only network reachability to the FOG server and knowledge of one registered host's MAC address. No authentication is required on the injection side. The payload activates when a privileged user views the affected inventory view.

Root Cause

The root cause is missing output encoding at the presentation layer. FOG stores inventory data as received from network clients and later interpolates it into HTML using str_replace() rather than an escaping function such as htmlspecialchars(). The trust boundary between untrusted client-supplied inventory data and rendered administrator HTML is not enforced.

Attack Vector

An attacker first enumerates or learns a MAC address of a host registered with FOG. This can occur through passive network observation on an adjacent network. The attacker then issues an HTTP POST request to /service/inventory.php supplying that MAC address and injecting a script payload into inventory fields such as sysproduct or sysserial. The value persists in the FOG database. When an administrator opens the Group Inventory tab, the browser parses the stored payload as HTML and executes the attacker's JavaScript within the authenticated admin session, enabling session token theft, CSRF-style privileged actions, and pivoting into managed hosts through FOG's deployment features.

A verified proof-of-concept has not been published. Refer to the FOG Project GitHub Security Advisory GHSA-fqgf-j2gh-92cm for full technical context.

Detection Methods for CVE-2026-47689

Indicators of Compromise

HTTP POST requests to /service/inventory.php from hosts that are not legitimate FOG clients or from outside expected imaging VLANs
Inventory database rows in fields such as sysproduct, sysserial, sysversion, or sysvendor containing <script>, onerror=, onload=, javascript:, or HTML tag characters
Administrator browser console errors or unexpected outbound requests originating from the FOG Group Inventory page
New or modified admin accounts, API tokens, or task schedules created shortly after an administrator viewed inventory data

Detection Strategies

Query the FOG database for inventory columns containing <, >, or script substrings and treat matches as suspicious
Enable web server access logging on the FOG host and alert on POSTs to /service/inventory.php from unexpected source IPs
Deploy a web application firewall rule that inspects request bodies to /service/inventory.php for HTML tags and JavaScript event handlers

Monitoring Recommendations

Baseline the set of MAC addresses and source IPs that legitimately report inventory and alert on deviations
Forward FOG Apache or Nginx logs to a centralized logging platform and retain them for correlation with administrator session activity
Monitor administrator account activity in FOG for privilege changes, new task creations, and image deployments outside normal change windows

How to Mitigate CVE-2026-47689

Immediate Actions Required

Upgrade FOG to version 1.5.10.1832 or 1.6.0-beta.2313 or later without delay
Restrict network access to the FOG server, especially /service/inventory.php, to imaging VLANs and known client subnets
Audit the inventory database for stored payloads containing HTML or JavaScript and sanitize or remove offending rows before administrators open the Group Inventory tab
Rotate FOG administrator credentials and API tokens if suspicious inventory entries are found

Patch Information

The FOG Project addressed CVE-2026-47689 in versions 1.5.10.1832 and 1.6.0-beta.2313. The fix applies HTML escaping to inventory field values before they are substituted into table cell templates by buildRow() in fogpage.class.php. See the FOG Project GitHub Security Advisory GHSA-fqgf-j2gh-92cm for release notes and commit references.

Workarounds

Place the FOG server behind network access controls that permit only trusted imaging clients to reach /service/inventory.php
Temporarily avoid opening the Group Inventory tab on unpatched deployments until the database is audited and the upgrade is applied
Apply a reverse proxy filter that rejects POST bodies to /service/inventory.php containing angle brackets or JavaScript keywords until an upgrade is completed

bash

# Example Nginx rule restricting inventory endpoint to an imaging subnet
location = /service/inventory.php {
    allow 10.20.30.0/24;   # imaging VLAN
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}