CVE-2026-28496: FOSSBilling Server-Side Template Injection in Twig Rendering
FOSSBilling versions prior to 0.8.0 contain a Server-Side Template Injection flaw in Twig template rendering, reachable by administrators through email templates, mass mail campaigns, custom payment adapters and the string_render API endpoint. The record states that successful exploitation can lead to information disclosure and remote code execution. Upgrading to 0.8.0 is the stated fix, and no confirmed exploitation in the wild appears in the sources consulted.
Overview
FOSSBilling is a free, open-source billing and client management system. This CVE describes a Server-Side Template Injection (SSTI) issue in its template rendering system, classified as CWE-1336 in the record.
Impact
An administrator with access to features that render Twig templates could inject arbitrary Twig expressions. The record states this can lead to information disclosure and remote code execution, because Twig templates are rendered without a sandbox, exposing the full Twig environment, the API context and the dependency injection container.
Affected products and versions
- The record describes FOSSBilling versions prior to 0.8.0 as affected.
- The structured affected and fixes fields in the record are empty, so the 0.8.0 boundary comes from the description text only.
- Features named in the description include email templates, mass mail campaigns, custom payment adapters and the string_render API endpoint.
Exploitation status
The CISA KEV catalog entry in the record is not listed. No confirmed exploitation in the wild appears in the sources consulted for this analysis.
Remediation and mitigation
- Upgrade FOSSBilling to version 0.8.0 or later, as stated in the description.
- Review existing email templates and other Twig-rendered content for unexpected expressions.
- Rotate administrator and client API tokens, especially where exposure is suspected.
- Limit external access to the /api/system/* paths at a reverse proxy or WAF, since the related advisory associates this issue with chaining with GHSA-78x5-c8gw-8279.
- Restrict administrative privileges to trusted personnel.
Detection guidance
- Monitor changes to email templates, mass mail content and payment adapter configuration for template syntax that staff did not author.
- Review API logs for unusual use of string rendering functionality.
- Watch for unexpected outbound connections or data leaving the billing host.
Limitations of the available information
The record has no populated affected product or fixed version entries, no EPSS or SSVC data, and only a single CNA-provided CVSS score. Its status is Deferred. Exploit conditions beyond the description are unknown.
Frequently asked questions
Which FOSSBilling versions are affected by CVE-2026-28496?
The record describes versions prior to 0.8.0 as affected. The structured affected product fields are empty, so the boundary comes from the description text.
Is there a fix for this vulnerability?
Yes. The description states that version 0.8.0 patches the issue. Administrators should also review email templates and rotate API tokens as suggested in the record.
Is this vulnerability known to be exploited in the wild?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.