What is the CVSS score of EUVD-2026-46413?

EUVD-2026-46413 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of FOG Project are affected by EUVD-2026-46413?

FOG Project in versions prior to 1.5.10.1832 contains a vulnerability allowing attackers to compromise administrator accounts through the inventory system, directly threatening IT infrastructure…. A patch is available.

How to fix or mitigate EUVD-2026-46413?

Within 24 hours, identify and catalog all FOG Project deployments, confirming which instances run vulnerable versions prior to 1.5.10.1832 (stable) or 1.6.0-beta.2313 (beta). Within 7 days, upgrade all production FOG Project instances to version 1.5.10.1832 or later (stable branch) or 1.6.0-beta.2313 or later (beta branch). Within 30 days, complete patching across all remaining instances and review access logs for the /service/inventory.php endpoint to identify any exploitation attempts during the pre-patch window.

FOG Project EUVD-2026-46413

| CVE-2026-47685 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 GitHub_M

PHP XSS Fogproject

8.7

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

HIGH

qualitative

NVD

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Endpoint is explicitly unauthenticated (PR:N); admin must view inventory page to trigger execution (UI:R); payload executes in admin session causing scope change (S:C, C:H, I:H); no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 07, 2026 - 14:01 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 07, 2026 - 13:52 vuln.today

cvss_changed

CVSS changed

Aug 07, 2026 - 13:52 NVD

7.3 (HIGH) 8.7 (HIGH)

Patch available

Jul 21, 2026 - 23:36 EUVD

Analysis Generated

Jul 21, 2026 - 21:04 vuln.today

CVE Published

Jul 21, 2026 - 20:37 cve.org

HIGH 7.3

DescriptionNVD

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (/service/inventory.php) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that executes in any administrator's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

Articles & Coverage 1

News 5 New PHP Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026

AnalysisAI

Stored XSS in FOG Project's unauthenticated inventory endpoint allows network-accessible attackers to inject persistent malicious scripts that execute in any administrator's browser session. Affecting fogproject versions prior to 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta), the flaw chains an unsanitized write path at /service/inventory.php with unencoded HTML rendering on the Host Management Inventory page, producing a scope-changing XSS condition with high confidentiality and integrity impact on the admin session. No public exploit has been identified at time of analysis, but the unauthenticated write vector combined with high-privilege execution context makes this a high-priority patch despite a low EPSS score of 0.20%.

Technical ContextAI

FOG Project (cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*) is a PHP-based open-source system for mass computer imaging, cloning, and hardware inventory management, commonly deployed in enterprise IT and educational environments. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) and arises from two compounding weaknesses in the PHP codebase: the /service/inventory.php endpoint, which FOG client agents use to report hardware inventory data, accepts client-supplied field values without any input sanitization and persists them directly to the database; and the Host Management Inventory administrative page renders those stored values into HTML without output encoding. This classic stored XSS pattern means attacker-controlled data written via the unauthenticated inventory service is later reflected and executed in the privileged administrative browser context whenever an administrator reviews host inventory.

RemediationAI

Upgrade to FOG Project version 1.5.10.1832 (stable branch) or 1.6.0-beta.2313 (beta branch) or later, as documented in the vendor advisory at https://github.com/FOGProject/fogproject/security/advisories/GHSA-2r7m-6mqf-5cc4. If immediate upgrade is not feasible, restrict network access to /service/inventory.php at the web server or perimeter firewall level, limiting it to only the IP ranges of known managed FOG client endpoints - this eliminates the unauthenticated write path that enables payload injection. Be aware that blocking /service/inventory.php will prevent FOG client agents from submitting hardware inventory updates, so coordinate this restriction with maintenance windows. Additionally, administrators should refrain from browsing the Host Management Inventory page until patched, as previously injected payloads remain stored in the database and will execute on page load. Patch versions confirmed by vendor advisory; no workaround independently verified as fully equivalent to patching.