Executive brief
FOG is an open-source tool used by IT departments to manage computer inventories and deploy operating system images across a network. A security flaw allows an unauthorized person on the local network to inject malicious code into the system's inventory records by spoofing a known device's hardware (MAC) address. If an IT administrator later views the inventory for a group of computers, this malicious code will execute in their browser, potentially allowing the attacker to hijack the administrator's session or perform unauthorized management tasks.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in FOG Project due to insufficient output encoding in the `buildRow()` method within `fogpage.class.php`. The application uses `str_replace()` to substitute inventory data into HTML templates without applying `htmlspecialchars()` or similar escaping. An unauthenticated attacker who knows a registered host's MAC address can send a POST request to `/service/inventory.php` containing malicious payloads in fields like `sysproduct` or `sysserial`. These values are stored in the database and subsequently rendered as executable HTML/JavaScript when an administrator accesses the Group Inventory tab. The vulnerability is exacerbated by a Content Security Policy (CSP) that permits 'unsafe-inline' scripts. The issue is resolved in versions 1.5.10.1832 and 1.6.0-beta.2313.
Affected products
- FOGProject FOG Project < 1.5.10.1832, < 1.6.0-beta.2313
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE published to NVD