An authenticated user with limited privileges can change critical Storage Node parameters through the API, which the application incorrectly trusts. By altering the node's user, password, and FTP path, the attacker exploits an input interpolation flaw that causes the server‑side FOGImageReplicator to run a shell command with root privileges. The vulnerability stems from improper input validation and insufficient authorization checks, allowing a low‑privileged API user to bypass administrative controls and achieve remote command execution. The tactic can compromise a full system because the exploited command runs as the root account, granting the attacker complete system control.

FOGProject’s fogproject, affected by versions prior to 1.5.10.2253 and 1.6.0‑RC‑1 into the source code. Users running an API‑enabled instance with a global token and a low‑privileged user (uType=1) who has both user and global API keys are at risk when storage replication is enabled and a functional storage node exists. All installations using the aforementioned versions before the release of 1.5.10.2253 or 1.6.0‑RC‑1 should verify their running version.

The vulnerability scores a CVSS of 8.8, indicating high severity. EPSS data is currently unavailable, but the lack of a KEV listing does not diminish its potential impact. The exploit requires legitimate API credentials and the global token, implying that attackers must first gain API access; however, once granted, the attacker can exploit the system without additional privileges. The flaw can be leveraged by injecting malicious FTP credentials that expand into exec calls, allowing arbitrary shell commands. Because the underlying service runs as root, a successful exploitation results in complete system compromise.