Executive brief
FOG is an open-source tool used by IT departments to manage computer inventory and deploy operating system images to many machines at once. A security flaw allows an attacker to inject malicious code into the system's inventory records without needing a password. If an IT administrator later views the details of an affected computer in the management console, the malicious code will run in their browser, potentially allowing the attacker to take over the management system, steal sensitive data, or create unauthorized administrator accounts.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in FOG Project due to improper input sanitization and output encoding. The unauthenticated inventory service endpoint (/service/inventory.php) accepts and persists base64-encoded client-supplied values into the database without validation. When an administrator views the Host Management Inventory page, these static inventory fields (such as system manufacturer or BIOS vendor) are rendered into the HTML template using a literal string replacement without output encoding. Because the application's Content Security Policy (CSP) allows 'unsafe-inline', the injected scripts execute in the context of the administrator's session. This allows for session hijacking, unauthorized account creation, or full compromise of the management console. The issue is fixed in versions 1.5.10.1832 and 1.6.0-beta.2313.
Affected products
- FOGProject fogproject < 1.5.10.1832, < 1.6.0-beta.2313
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE published to NVD