Read the docs
TI-2026-31983 Aliases CVE-2026-43921

FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

Priority MEDIUM 41CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 36th percentileScored 2026-11-07
Fix Fixed FOSSBilling (FOSSBilling): 0.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FOSSBillingFOSSBilling0.6.10 to before 0.8.00.8.0Patch availableCNA
  • FOSSBilling VendorFOSSBilling Affected 0.6.10 to before 0.8.0 Fixed in 0.8.0 Patch available CNA

Remediation

  • Fix · CNA FOSSBilling (FOSSBilling) Fixed in 0.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43921

References

Other 1

  • TI-2023-03258 SQL Injection in fossbilling/fossbilling CVSS 3.1CRITICAL 9.8
  • TI-2023-03719 Insufficient Session Expiration in fossbilling/fossbilling CVSS 3.1CRITICAL 9.8
  • TI-2023-03259 Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling CVSS 3.1HIGH 8.8
  • TI-2023-03261 Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling CVSS 3.1HIGH 8.0
  • TI-2026-30636 FOSSBilling missing authorization in guest Invoice API endpoints CVSS 4.0HIGH 7.7
  • TI-2023-03173 Code Injection in fossbilling/fossbilling CVSS 3.1HIGH 7.2
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences