Is CVE-2026-28496 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28496 being exploited in the wild.

How severe is CVE-2026-28496?

Informational severity, with a CVSS score of 9.4, published 23 June 2026.

Is there a fix for CVE-2026-28496?

A patch was published on 2026-05-28: Version 0.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28496 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-28496?

Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28496: FOSSBilling Server-Side Template Injection in Twig rendering

CVE-2026-28496 · Severity: info · CVSS 9.4 · Published 2026-06-23

FOSSBilling, an open-source platform used by hosting providers to manage billing and client accounts, contains a critical flaw in its template system. This vulnerability allows an attacker to execute malicious code on the server or access sensitive customer and financial data. While normally requiring administrative access, this flaw can be combined with a separate security bypass to allow completely unauthenticated attackers to take full control of the system and its database.

Technologies: FOSSBilling. Vendors: FOSSBilling.

Quick answers

Is CVE-2026-28496 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28496 being exploited in the wild.
How severe is CVE-2026-28496?: Informational severity, with a CVSS score of 9.4, published 23 June 2026.
Which products and versions are affected?: FOSSBilling < 0.8.0.
Is there a fix for CVE-2026-28496?: A patch was published on 2026-05-28: Version 0.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28496 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-28496?: Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's template rendering system due to the use of Twig without a sandbox. Affected components include email templates, mass mailers, and the 'string_render' API endpoint. Because the Twig environment is configured with access to the application's dependency injection (DI) container via the getDi() method, an attacker can escalate from template injection to arbitrary SQL execution and remote code execution (RCE). While the vulnerability natively requires administrative privileges, it can be chained with CVE-2026-28497 (GHSA-78x5-c8gw-8279), an authorization bypass in the /api/system/* endpoints, to achieve unauthenticated RCE. The issue is resolved in version 0.8.0.

Affected products

FOSSBilling FOSSBilling < 0.8.0

Timeline

2026-05-28: patched: Version 0.8.0 released
2026-06-20: advisory: GitHub Security Advisory published
2026-06-23: disclosed: NVD publication and VulnCheck blog post

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.