Executive brief
FOG is an open-source tool used for managing computer imaging and inventory across networks. A security flaw allows an attacker to inject malicious code into the system's inventory database. When an administrator later views inventory reports, this code executes in their browser, potentially allowing the attacker to hijack the administrator's session or perform unauthorized actions on the network management server.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in FOG Project due to improper output encoding in the `selectForm()` helper within `fogpage.class.php`. The `selectForm()` method fails to escape labels for `<option>` elements, rendering raw user input from the database. An attacker who knows a registered host's MAC address can send a malicious `sysproduct` value via an unauthenticated POST request to `/service/inventory.php`. This payload is stored in the inventory database and executes arbitrary JavaScript in the context of an administrator's browser when they access the 'Reports > Inventory' page. The vulnerability is further facilitated by a Content Security Policy (CSP) that allows 'unsafe-inline' scripts. The issue is resolved in versions 1.5.10.1832 and 1.6.0-beta.2313 by applying proper escaping to the affected labels.
Affected products
- FOGProject fogproject < 1.5.10.1832, < 1.6.0-beta.2313
Timeline
- 2026-05-19: advisory: Initial GHSA advisory published
- 2026-07-21: disclosed: CVE published to NVD