PT-2026-4317 · Fog · Fog

Soptikha2 · Publicado 2026-01-23 · Atualizado 2026-01-28 · CVE-2026-24138

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FOG versions 1.5.10.1754 and below

Description FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated Server-Side Request Forgery (SSRF) condition in the getversion.php file. This can be triggered by providing a user-controlled URL parameter. The issue allows fetching both internal websites and files on the machine running FOG. The condition appears to be reachable without an authenticated web session when the request includes newService=1. The API endpoint involved is getversion.php and the vulnerable parameter is the URL parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-24138

GHSA-79XW-C2QX-G7XJ

Produtos afetados

Fog

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24138.json · Exploit
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-79xw-c2qx-g7xj · Nota
• https://twitter.com/CVEnew/status/2014576988405854576 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24138 · Aviso do Fabricante
• https://t.me/cveNotify/149638 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2014517430400250319 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24138 · Nota de Segurança
• https://twitter.com/cracbot/status/2016466354732466223 · Publicação no Twitter