CVE-2026-47689 FOGProject CVE debrief

Who should care

Administrators and users of the FOG Project, especially those who manage inventory and use the Group Inventory tab, should be aware of this vulnerability and take immediate action to update to a patched version. This includes reviewing and sanitizing user-input data in inventory values and monitoring for suspicious activity on the Group Inventory tab. Security teams and vulnerability management teams should prioritize this issue due to its potential impact on system security and data integrity.

Technical summary

The vulnerability exists in the `buildRow()` method of `fogpage.class.php`, where user-input data is not properly sanitized before being used to generate HTML table cells. This allows for the injection of malicious JavaScript code, which can be executed when an administrator views the Group Inventory tab. The issue arises from the use of `str_replace()` without HTML escaping, enabling an unauthenticated attacker with knowledge of a registered host's MAC address to inject malicious inventory values. These values are stored in the database and executed as HTML/JavaScript when an administrator accesses the Group Inventory tab.

Defensive priority

High

Recommended defensive actions

• Update to version 1.5.10.1832 or 1.6.0-beta.2313 or later
• Review and sanitize user-input data in inventory values
• Monitor for suspicious activity on the Group Inventory tab
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-21T21:16:50.937Z and last modified on 2026-07-22T19:17:05.743Z. The NVD entry is currently available. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impacts. Defenders should verify the official CVE record and NVD entry for the latest information. The CVE-2026-47689 record indicates that FOG is vulnerable to a stored cross-site scripting (XSS) attack. The `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. This allows an unauthenticated attacker who knows any registered host's MAC address to POST malicious inventory values to `/service/inventory.php`, which stores them in the database.

Official resources