PT-2026-28520 · Fog · Fog

Published 2026-03-27 · Updated 2026-04-08 · CVE-2026-33739

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions FOG versions prior to 1.5.10.1812

Description FOG, a free open-source cloning/imaging/rescue suite/inventory management system, contains a Stored Cross-Site Scripting (XSS) issue. This occurs due to insufficient server-side parameter sanitization during record creation and updates, combined with a lack of HTML escaping in listing tables on multiple management pages including Host, Storage, Group, Image, Printer, and Snapin. The issue allows for the injection of malicious scripts that can be executed in the context of other users' browsers.

Recommendations Update to version 1.5.10.1812 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33739

GHSA-8M2F-4X7G-P8F3

Affected Products

Fog

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33739.json · Exploit
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-8m2f-4x7g-p8f3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33739 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33739 · Vendor Advisory
• https://twitter.com/CVEnew/status/2037719412703408187 · Twitter Post
• https://t.me/cveNotify/158457 · Telegram Post