CVE-2026-47689: FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow() method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace() without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. sysproduct, sysserial) to /service/inventory.php, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOGProjectto a version that resolves this vulnerability.Fixed in 1.5.10.1832 - Upgrade
Upgrade
FOGProjectto a version that resolves this vulnerability.Fixed in 1.6.0-beta.2313
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47689?
The severity of CVE-2026-47689 is medium with a score of 4.6.
What type of vulnerability is CVE-2026-47689?
CVE-2026-47689 is a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-47689?
To fix CVE-2026-47689, upgrade to FOGProject versions 1.5.10.1832 or 1.6.0-beta.2313 or later.
What impact does CVE-2026-47689 have on the system?
CVE-2026-47689 allows an unauthenticated attacker to execute arbitrary JavaScript code in the context of an affected user's session.
In which component of FOGProject is CVE-2026-47689 found?
CVE-2026-47689 is found in the `buildRow()` method within the `fogpage.class.php` file.