# CVE-2026-33734: FOSSBilling SQL injection in Massmailer module

Source: https://junglewise.ai/threats/cve-2026-33734-fossbilling-sql-injection-in-massmailer-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-33734 · Severity: info · CVSS 6.9 · Published 2026-07-06

FOSSBilling, an open-source billing and client management platform, contains a security flaw in its mass mailing tool. An authorized administrator can use specially crafted filters to gain unauthorized access to the underlying database. This could lead to the theft of sensitive customer data, administrator password hashes, and system configuration details.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-33734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33734 being exploited in the wild.

**How severe is CVE-2026-33734?** Informational severity, with a CVSS score of 6.9, published 6 July 2026.

**Which products and versions are affected?** FOSSBilling 0.6.0 - 0.7.2.

**Is there a fix for CVE-2026-33734?** A patch was published on 2026-08-01: Version 0.8.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33734 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33734?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the `Massmailer` module of FOSSBilling due to improper neutralization of user-supplied filters. In `src/modules/Massmailer/Service.php`, the `getMessageReceivers` function uses `sprintf` and `implode` to interpolate JSON-decoded filter values directly into a SQL query without parameterization. An authenticated attacker with administrator privileges can submit a crafted `message_update` API request containing SQL payloads in fields like `client_status`. When the administrator subsequently triggers a recipient preview or sends the message, the payload executes, allowing for full data exfiltration from the database. The issue is resolved in version 0.8.0.

## Affected products

- FOSSBilling FOSSBilling 0.6.0 - 0.7.2

## Timeline

- 2026-06-12: advisory: GitHub security advisory published
- 2026-07-06: disclosed: CVE published to NVD
- 2026-08-01: patched: Version 0.8.0 released to address the vulnerability

## References

- [https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-2899](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-2899)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management)