The vulnerability is an unauthenticated Server Side Request Forgery that can be triggered through the getversion.php endpoint of FOGProject when the newService=1 parameter is included and a user‑controlled URL is supplied. The flaw allows the attacker to command the FOG server to fetch arbitrary URLs or local files, giving them the ability to read internal web pages, services, or file data on the host. Depending on the exposed internal resources, this could lead to further exploitation such as additional SSRF or remote code execution if those services are vulnerable.

FOGProject, specifically FOGProject 1.5.10.1754 and earlier. No fixed release available at the time of publication. The flaw is present in all installations of the indicated versions across platforms supported by FOG.

The CVSS score of 7.5 indicates a high severity due to the combined impact of data exposure and potential compromise of internal resources. The EPSS score is less than 1% reflecting a low probability that this flaw will be exploited in the wild at the time of analysis. The flaw is not listed as a known exploited vulnerability in the CISA KEV catalog. Exploitation requires the ability to send an HTTP request to the vulnerable endpoint, which can be done from any network that can reach the FOG server. No authentication or complex prerequisites are needed beyond sending a request with newService=1 and a URL parameter, making the attack path straightforward for an attacker with network access to the victim.