PT-2026-4317 · Fog · Fog

Soptikha2 · Published 2026-01-23 · Updated 2026-01-28 · CVE-2026-24138

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FOG versions 1.5.10.1754 and below

Description FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated Server-Side Request Forgery (SSRF) condition in the getversion.php file. This can be triggered by providing a user-controlled URL parameter. The issue allows fetching both internal websites and files on the machine running FOG. The condition appears to be reachable without an authenticated web session when the request includes newService=1. The API endpoint involved is getversion.php and the vulnerable parameter is the URL parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-24138

GHSA-79XW-C2QX-G7XJ

Affected Products

Fog

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24138.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-24138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24138 · Security Note
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-79xw-c2qx-g7xj · Note
• https://twitter.com/CVEnew/status/2014576988405854576 · Twitter Post
• https://t.me/cveNotify/149638 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014517430400250319 · Twitter Post
• https://twitter.com/cracbot/status/2016466354732466223 · Twitter Post