CVE-2024-39916

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30.

• CWE-453
• CWE-1188

• https://github.com/FOGProject/fogproject/commit/2de209bc57a177a052b4a877f000c591740b2f88Patch
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-3xjr-xf9v-hwjhThird Party Advisory
• https://github.com/FOGProject/fogproject/commit/2de209bc57a177a052b4a877f000c591740b2f88Patch
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-3xjr-xf9v-hwjhThird Party Advisory

Published

Jul 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3991The ShopLentor – WooCommerce Builder for Elementor & Gutenbe…5.4
• CVE-2024-39910decidim is a Free Open-Source participatory democracy, citiz…4.8
• CVE-2024-399111Panel is a web-based linux server management control panel.…9.8
• CVE-2024-39912web-auth/webauthn-lib is an open source set of PHP libraries…5.3
• CVE-2024-39914FOG is a cloning/imaging/rescue suite/inventory management s…9.8
• CVE-2024-39915Thruk is a multibackend monitoring webinterface for Naemon, …9.9
• CVE-2024-39917xrdp is an open source RDP server. xrdp versions prior to 0.…9.8
• CVE-2024-39918@jmondi/url-to-png is an open source URL to PNG utility feat…4.3
• CVE-2024-39919@jmondi/url-to-png is an open source URL to PNG utility feat…3.1
• CVE-2024-3992The Amen WordPress plugin through 3.3.1 does not sanitise an…4.8
• CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that …4.3
• CVE-2024-39921Observable timing discrepancy issue exists in IPCOM EX2 Seri…7.5