CVE-2026-24138

HIGH EPSS 29.9%

Published Jan 23, 20265mo ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Jan 23, 2026 5mo ago

Last Modified Jun 17, 2026 2w ago

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites and files on the machine running FOG. This appears to be reachable without an authenticated web session when the request includes newService=1. The issue does not have a fixed release version at the time of publication.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

29.9% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

References 1

github.com https://github.com/FOGProject/fogproject/security/advisories/GHSA-79xw-c2qx-g7xj

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.