FOG path traversal via unauthenticated endpoint
Priority LOW 33CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00576 47th percentileScored 2026-11-07
Fix Fixed fogproject (FOGProject): 1.5.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FOGProject | fogproject | before 1.5.10 | 1.5.10 | Patch available | CNA |
- fogproject VendorFOGProject Affected before 1.5.10 Fixed in 1.5.10 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:* | before 1.5.10 | Vulnerable | FOGProject |
- cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:* Versions before 1.5.10 Vulnerable ·FOGProject
Remediation
- Fix · CNA fogproject (FOGProject) Fixed in 1.5.10
Timeline
- 2026-10-02 Threatist record created from CVE-2023-46237
References
More Fogproject vulnerabilities
- TI-2025-36201 FOG's authentication bypass leads to full SQL DB dump CVSS 4.0CRITICAL 9.9
- TI-2024-26807 FOG has a command injection in /fog/management/export.php?filename= CVSS 3.1CRITICAL 9.8
- TI-2024-28335 FOG leaks sensitive information (AD domain, username and password) CVSS 3.1CRITICAL 9.3
- TI-2026-35192 Missing authorization in fogproject CVSS 3.1HIGH 8.2
- TI-2026-35191 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint CVSS 3.1HIGH 8.7
- TI-2024-27056 FOG Authenticated File Upload RCE CVSS 3.1HIGH 8.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences