---
id: CVE-2026-116778
title: >-
  FOG: Authenticated low-privileged API user can modify Storage Nodes and reach
  root command execution
summary: >-
  FOG is a free open-source cloning/imaging/rescue suite/inventory management
  system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user
  with uType=1 who possesses both the user's API token and the global FOG API
  token …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-862
vendor: FOGProject
product: fogproject
affected:
  - fogproject < 1.5.10.2253
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-28T16:05:07.319872Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:06:35.677Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116778'
references:
  - url: >-
      https://github.com/FOGProject/fogproject/security/advisories/GHSA-2hqx-5ffg-w4c3
    label: >-
      https://github.com/FOGProject/fogproject/security/advisories/GHSA-2hqx-5ffg-w4c3
  - url: 'https://github.com/FOGProject/fogproject/pull/1001'
    label: 'https://github.com/FOGProject/fogproject/pull/1001'
  - url: >-
      https://github.com/FOGProject/fogproject/commit/3098e4423588951d8f0cedac79b9b102f036761e
    label: >-
      https://github.com/FOGProject/fogproject/commit/3098e4423588951d8f0cedac79b9b102f036761e
  - url: >-
      https://github.com/FOGProject/fogproject/commit/aeda5bc536e3eec0200366d6b109a66798abc438
    label: >-
      https://github.com/FOGProject/fogproject/commit/aeda5bc536e3eec0200366d6b109a66798abc438
  - url: 'https://github.com/FOGProject/fogproject/releases/tag/1.5.10.2253'
    label: 'https://github.com/FOGProject/fogproject/releases/tag/1.5.10.2253'
  - url: 'https://github.com/FOGProject/fogproject/releases/tag/1.6.0-RC-1'
    label: 'https://github.com/FOGProject/fogproject/releases/tag/1.6.0-RC-1'
tags:
  - cve.org
ingestedAt: '2026-10-28T16:13:50.581Z'
---

## Overview

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.

## Affected

- `fogproject < 1.5.10.2253`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.