What is the CVSS score of CVE-2026-47689?

CVE-2026-47689 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47689?

Yes, a patch is available for CVE-2026-47689. Update the affected software to the latest version immediately.

FOG Project CVE-2026-47689

EUVD-2026-46417 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 GitHub_M

PHP XSS Fogproject

5.2

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

5.2 MEDIUM

AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.6 MEDIUM

AV:A reflects the internally-facing inventory endpoint; PR:N because no authentication is required to POST inventory data; UI:R because the XSS payload only fires when an admin views the Group Inventory tab.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:A/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 07, 2026 - 14:07 NVD

4.6 (MEDIUM) 5.2 (MEDIUM)

Patch available

Jul 21, 2026 - 23:36 EUVD

Analysis Generated

Jul 21, 2026 - 21:45 vuln.today

DescriptionNVD

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow() method in fogpage.class.php substitutes data values into HTML table cell templates using str_replace() without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. sysproduct, sysserial) to /service/inventory.php, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

AnalysisAI

Stored cross-site scripting in FOG Project's inventory pipeline allows an unauthenticated network-adjacent attacker who knows any registered host's MAC address to inject persistent JavaScript payloads into the FOG database via POST requests to /service/inventory.php. When an administrator opens the Group Inventory tab, the unescaped payload executes in their browser, enabling session hijacking or unauthorized admin-level actions. No public exploit has been identified at time of analysis; patches are available in versions 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta).

Technical ContextAI

FOG Project (CPE: cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*) is a PHP-based open-source network imaging and inventory management system widely used in educational institutions and SMB IT departments. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, the buildRow() method in fogpage.class.php uses PHP's str_replace() to substitute database-sourced values into HTML table cell templates without applying any htmlspecialchars() or equivalent encoding. The /service/inventory.php endpoint accepts unauthenticated POST requests carrying inventory fields such as sysproduct and sysserial, which are designed to be submitted by FOG imaging agents on the network and are stored verbatim in the database. Because no sanitization occurs at either ingestion or render time, attacker-controlled values survive to execution when rendered in the admin panel's Group Inventory tab.

RemediationAI

Upgrade FOG Project to version 1.5.10.1832 (stable) or 1.6.0-beta.2313 (beta), which introduce HTML escaping in the buildRow() rendering path; details are at https://github.com/FOGProject/fogproject/security/advisories/GHSA-fqgf-j2gh-92cm. If immediate upgrade is not feasible, restrict POST access to /service/inventory.php via firewall ACLs or web server location blocks to allow only IP addresses of known imaging hosts - this prevents unauthenticated payload injection but will block inventory collection from any unallowlisted host, so the allowlist must be maintained carefully. As a secondary control, limit admin access to the Group Inventory tab to sessions originating from trusted management networks, reducing the window in which a stored payload can fire.