Stored Cross-Site Scripting in FOG Project Affects Inventory Management Features
CVE-2026-47685

7.3HIGH

Key Information:

Vendor

Fogproject

Status
Fogproject
Vendor
CVE Published:
21 July 2026

What is CVE-2026-47685?

The FOG Project is a free open-source software suite for cloning, imaging, and managing inventory. An identified vulnerability in versions earlier than 1.5.10.1832 and 1.6.0-beta.2313 allows attackers to exploit the unauthenticated inventory service endpoint (/service/inventory.php). This endpoint can inadvertently persist unsanitized client-supplied values, leading to stored cross-site scripting (XSS) vulnerabilities. Consequently, if an administrator views affected inventory pages, arbitrary scripts could execute within their browser context, posing significant security risks.

Affected Version(s)

fogproject < 1.5.10.1832 < 1.5.10.1832

fogproject < 1.6.0-beta.2313 < 1.6.0-beta.2313

References

https://github.com/FOGProject/fogproject/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.