Missing authorization in FOG API enables root command execution
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78 and CWE-862.
Summary
FOG before 1.5.10.2253 and 1.6.0-RC-1 lets an authenticated API user with low privileges change Storage Node settings. The API does not enforce an administrator-only role, and the replication service later runs those values unsanitized in a command as root (CWE-78). An attacker needs their own API token and the global FOG API token, plus storage replication enabled with a usable Storage Node.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FOGProject | fogproject | before 1.5.10.2253 | 1.5.10.2253 | Patch available | CNA |
- fogproject VendorFOGProject Affected before 1.5.10.2253 Fixed in 1.5.10.2253 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:* | — | — | FOGProject |
- cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:* Versions — — ·FOGProject
Remediation
Update FOG to version 1.5.10.2253 or 1.6.0-RC-1, the fixed versions for FOGProject fogproject.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA fogproject (FOGProject) Fixed in 1.5.10.2253
Timeline
- 2026-10-28 Threatist record created from CVE-2026-116778
- 2026-10-30 Priority changed: LOW → MEDIUM
References
Other 6
- https://github.com/FOGProject/fogproject/security/advisories/GHSA-2hqx-5ffg-w4c3
- https://github.com/FOGProject/fogproject/pull/1001
- https://github.com/FOGProject/fogproject/commit/3098e4423588951d8f0cedac79b9b102f036761e
- https://github.com/FOGProject/fogproject/commit/aeda5bc536e3eec0200366d6b109a66798abc438
- https://github.com/FOGProject/fogproject/releases/tag/1.5.10.2253
- https://github.com/FOGProject/fogproject/releases/tag/1.6.0-RC-1
More FOGProject vulnerabilities
- TI-2025-36201 FOG's authentication bypass leads to full SQL DB dump CVSS 4.0CRITICAL 9.9
- TI-2024-26807 FOG has a command injection in /fog/management/export.php?filename= CVSS 3.1CRITICAL 9.8
- TI-2024-28335 FOG leaks sensitive information (AD domain, username and password) CVSS 3.1CRITICAL 9.3
- TI-2026-35192 Missing authorization in fogproject CVSS 3.1HIGH 8.2
- TI-2026-35191 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint CVSS 3.1HIGH 8.7
- TI-2024-27056 FOG Authenticated File Upload RCE CVSS 3.1HIGH 8.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences