Executive brief
FOSSBilling, an open-source billing and client management platform, contains a flaw that reveals its exact software version to any visitor, even when configured to hide this information. While not a direct breach of customer data, this allows potential attackers to easily identify known vulnerabilities specific to that version. Knowing the exact version simplifies the process of planning and executing targeted attacks against the system.
Technical details
FOSSBilling versions prior to 0.8.0 fail to honor the 'hide_version_public' security setting within its Twig templating filters. Specifically, the 'twig_script_tag()' and 'twig_stylesheet_tag()' methods unconditionally append the system version string as a query parameter (e.g., '?v=0.7.2') to all generated <script> and <link> tags. This occurs because the version is used as a cache buster and was overlooked when implementing version-hiding logic for HTTP headers and API endpoints. An unauthenticated remote attacker can perform reconnaissance by inspecting the HTML source of any public page to identify the exact software version, facilitating the selection of version-specific exploits. The issue is resolved in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling < 0.8.0
Timeline
- 2026-05-28: patched: Version 0.8.0 released
- 2026-05-30: advisory: GitHub Security Advisory published
- 2026-06-03: disclosed: CVE published to NVD