Executive brief
FOSSBilling, an open-source platform used by hosting providers to manage billing and client accounts, contains a critical flaw in its template system. This vulnerability allows an attacker to execute malicious code on the server or access sensitive customer and financial data. While normally requiring administrative access, this flaw can be combined with a separate security bypass to allow completely unauthenticated attackers to take full control of the system and its database.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's template rendering system due to the use of Twig without a sandbox. Affected components include email templates, mass mailers, and the 'string_render' API endpoint. Because the Twig environment is configured with access to the application's dependency injection (DI) container via the getDi() method, an attacker can escalate from template injection to arbitrary SQL execution and remote code execution (RCE). While the vulnerability natively requires administrative privileges, it can be chained with CVE-2026-28497 (GHSA-78x5-c8gw-8279), an authorization bypass in the /api/system/* endpoints, to achieve unauthenticated RCE. The issue is resolved in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling < 0.8.0
Timeline
- 2026-05-28: patched: Version 0.8.0 released
- 2026-06-20: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication and VulnCheck blog post