Read the docs
TI-2024-27056 Aliases CVE-2024-40645

FOG Authenticated File Upload RCE

Priority HIGH 73CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has a check on the client banner image requiring it to be 650 pixels wide and 120 pixels high. Apart from that, there are no checks on things like file extensions. This can be abused by appending a PHP webshell to the end of the image and changing the extension to anything the PHP web server will parse. This vulnerability is fixed in 1.5.10.41.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00964 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed fogproject (FOGProject): 1.5.10.41

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FOGProjectfogprojectbefore 1.5.10.411.5.10.41Patch availableCNA
  • fogproject VendorFOGProject Affected before 1.5.10.41 Fixed in 1.5.10.41 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*1.5.10 – 1.5.10.41VulnerableFOGProject
  • cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:* Versions 1.5.10 – 1.5.10.41 Vulnerable ·FOGProject

Remediation

  • Fix · CNA fogproject (FOGProject) Fixed in 1.5.10.41

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-40645

References

Exploit 1

Patch 1

Other 1

  • TI-2025-36201 FOG's authentication bypass leads to full SQL DB dump CVSS 4.0CRITICAL 9.9
  • TI-2024-26807 FOG has a command injection in /fog/management/export.php?filename= CVSS 3.1CRITICAL 9.8
  • TI-2024-28335 FOG leaks sensitive information (AD domain, username and password) CVSS 3.1CRITICAL 9.3
  • TI-2026-35192 Missing authorization in fogproject CVSS 3.1HIGH 8.2
  • TI-2026-35191 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint CVSS 3.1HIGH 8.7
  • TI-2024-27460 FOG Sensitive Information Disclosure CVSS 3.1HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences