CVE-2026-24138: SSRF in FOGProject ≤ 1.5.10.1754

The SSRF vulnerability in FOGProject's getversion.php allows an attacker to craft a malicious URL parameter that triggers the server to make requests to arbitrary internal or external resources. Because the vulnerability is unauthenticated, an attacker does not need valid credentials to exploit it. This could lead to the exposure of sensitive internal data, such as configuration files, database credentials, or even access to other internal services. The newService=1 parameter appears to be a key component in triggering the vulnerability, bypassing authentication checks. Successful exploitation could allow an attacker to map the internal network and identify other potential targets for further attacks.

1. Reserved2026-01-21
2. Published2026-01-23
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24138 is to upgrade FOGProject to version 1.5.11 or later, which contains the fix. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests to getversion.php with suspicious URL parameters, specifically those containing user-controlled URLs. Additionally, restrict network access to the FOGProject server to only necessary IP addresses and ports. Monitor FOGProject logs for unusual outbound requests originating from getversion.php. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and verifying that the request is blocked.