Fogproject CVE-2026-33739

While the CVSS 5.7 score reflects the restricted attack surface (requires PR:H privileged access and UI:R user interaction), the real-world risk is notably elevated by the stored nature of the payload and the administrative context. An insider threat or compromised high-privilege account can persistently compromise all administrators viewing the affected pages, making this a privilege-escalation and persistence vector rather than a typical low-impact XSS. The high-privilege requirement (PR:H) and UI requirement (UI:R) cap the baseline score but do not eliminate the threat; stored XSS in administrative interfaces poses significant risk to system integrity and confidentiality. No EPSS score or KEV status provided; however, the stored nature and administrative scope elevate practical risk beyond the CVSS base score alone.

A disgruntled or compromised administrator with high-privilege FOG account credentials creates a new Host record with a malicious payload injected into a text field (e.g., hostname or description field). The payload is stored unsanitized in the database. When other administrators access the Host listing page to view or manage hosts, the injected script executes in their browser within the privileged administrative context, potentially stealing session cookies, session tokens, or credentials to perform unauthorized actions such as creating backdoor snapins, modifying cloning images, or exfiltrating inventory data.