CVE-2026-28496 Scanner

FOSSBilling is a widely used open-source billing and client management solution for hosting providers. It is typically utilized by administrators and developers who require a streamlined system for billing and client management. FOSSBilling's integration capabilities make it a popular choice for businesses seeking an efficient, customizable billing system. The software supports extensive third-party plugins, enhancing its functionality across various business environments. Many hosting companies rely on FOSSBilling for its robust features and adaptability to diverse billing needs. Its community-driven development ensures ongoing updates and improvements that meet user needs.

The Server Side Template Injection (SSTI) vulnerability allows attackers to inject and execute arbitrary code through templates. This vulnerability arises when the software fails to properly validate and sanitize untrusted input. Attackers can leverage SSTI vulnerabilities to execute server-side code, accessing sensitive information or performing unauthorized actions. In FOSSBilling, the vulnerability is associated with the template rendering system, which handles various administrative tasks. The unchecked rendering process can enable unauthorized access to critical systems and data. Proper handling and sanitization of inputs are essential to prevent such vulnerabilities.

Technically, this SSTI vulnerability affects FOSSBilling's template rendering system, specifically with the rendering of Twig templates. It occurs due to the absence of a sandbox during the rendering process, allowing full access to the Twig environment. This lack of restriction permits administrators to inject arbitrary expressions, compromising system security. Key vulnerable endpoints include email templates, mass mail campaigns, and custom payment adapters. Moreover, the string_render API endpoint is particularly vulnerable to crafted template injections. The unrestricted use of dependency injection containers heightens the potential impact of the vulnerability.

Exploiting this vulnerability can have dire consequences, including the potential compromise of the entire system. Attackers could execute arbitrary code, leading to unauthorized access and control over the application's functions. Sensitive information, including client data and system configurations, could be disclosed, impacting business operations and client trust. Moreover, the system could become a launchpad for further attacks against other network-connected resources. The exploitation of this vulnerability can also result in reputational damage and financial loss for affected organizations.

REFERENCES

• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc
• https://x.com/pyn3rd/status/2069260345571696951