CVE-2026-28496: FOSSBilling SSTI RCE Vulnerability

CVE-2026-28496 Overview

CVE-2026-28496 is a Server-Side Template Injection (SSTI) vulnerability in FOSSBilling, a free, open-source billing and client management system. All versions prior to 0.8.0 render Twig templates without a sandbox, exposing the full Twig environment, API context, and the application's dependency injection container to authenticated administrators. Attackers with access to features that render Twig templates such as email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint can inject arbitrary Twig expressions. Successful exploitation leads to information disclosure and remote code execution on the underlying host [CWE-1336]. Version 0.8.0 patches the issue.

Critical Impact
Authenticated administrators can achieve remote code execution on the FOSSBilling host by injecting Twig expressions, with chaining potential against the /api/system/* endpoints tracked in GHSA-78x5-c8gw-8279.

Affected Products

FOSSBilling versions prior to 0.8.0
Twig template rendering subsystem (email templates, mass mail campaigns, custom payment adapters)
The string_render API endpoint

Discovery Timeline

2026-06-23 - CVE-2026-28496 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-28496

Vulnerability Analysis

FOSSBilling embeds the Twig templating engine to render dynamic content across multiple administrative features. The application instantiates Twig without enabling the SandboxExtension, meaning every rendered template has full access to Twig filters, functions, and PHP object methods reachable through the API context and Pimple-style dependency injection container.

An administrator who can edit an email template, queue a mass mail campaign, define a custom payment adapter, or invoke the string_render API can supply Twig expressions that resolve to arbitrary PHP method calls. From that primitive, attackers reach service objects that expose file system, shell, and configuration operations, producing both information disclosure and remote code execution.

The issue is classified under CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine. VulnCheck research notes that the SSTI can be chained with the authentication bypass tracked as GHSA-78x5-c8gw-8279, allowing unauthenticated attackers to reach the vulnerable rendering paths through /api/system/*.

Root Cause

The root cause is the absence of sandboxing on the Twig environment used to render user-controlled templates. Because no allow-list restricts available tags, filters, functions, or method calls, any string passed through string_render or stored in template-bearing fields is evaluated with the privileges of the FOSSBilling PHP process.

Attack Vector

The vulnerability is exploited over the network against the FOSSBilling administrative interface or its /api/system/* endpoints. A high-privileged administrator account is normally required, but chaining with the related authentication bypass advisory removes that prerequisite. No user interaction is needed once the malicious template payload is submitted.

The payload is a Twig expression that traverses the dependency injection container to retrieve a service exposing shell, file, or database operations, then invokes it during template rendering. See the GitHub Security Advisory GHSA-57mv-jm88-66jc and the VulnCheck Blog Analysis for detailed technical walk-throughs.

Detection Methods for CVE-2026-28496

Indicators of Compromise

Email templates, mass mail content, or payment adapter configuration containing Twig control structures such as {{, {%, getEnvironment, _self, or references to the dependency injection container.
Unexpected outbound connections, file writes under the FOSSBilling web root, or new PHP files created by the web server account following administrative template edits.
Requests to /api/system/string_render or other /api/system/* endpoints from non-administrative source addresses.
New or unexpected admin sessions and API token creations preceding template modifications.

Detection Strategies

Inspect FOSSBilling database tables that store templates for Twig syntax that references PHP classes, services, or shell-related functions.
Alert on web server logs containing POST requests to template rendering or mass mail endpoints with payloads matching Twig expression patterns.
Monitor PHP process execution for child processes such as sh, bash, python, or curl spawned by the FOSSBilling web server user, which is anomalous in normal operation.
Correlate authentication bypass indicators from GHSA-78x5-c8gw-8279 with subsequent template rendering activity.

Monitoring Recommendations

Enable verbose application logging for the FOSSBilling admin area and forward to a central log platform for retention and search.
Track changes to records in the email_template, mod_massmailer, and payment adapter tables and review diffs for Twig expressions.
Watch reverse proxy or WAF telemetry for traffic to /api/system/* from unexpected client networks.

How to Mitigate CVE-2026-28496

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which removes the unsandboxed Twig rendering paths.
Audit all existing email templates, mass mail campaigns, and payment adapter configurations for suspicious Twig expressions and remove any that are not legitimate.
Rotate all admin and client API tokens after patching to invalidate any credentials that may have been exfiltrated.
Restrict administrative access to the FOSSBilling console to known networks and enforce multi-factor authentication on admin accounts.

Patch Information

FOSSBilling 0.8.0 patches the SSTI by constraining template rendering. Refer to the GitHub Security Advisory GHSA-57mv-jm88-66jc for the full fix description and the companion GitHub Security Advisory GHSA-78x5-c8gw-8279 for the chainable authentication bypass.

Workarounds

Block external access to /api/system/* at the reverse proxy or web application firewall to limit chaining with GHSA-78x5-c8gw-8279.
Limit administrative accounts to trusted operators and remove unused admin sessions until the upgrade is applied.
Disable the string_render API endpoint and mass mail features if they are not required in your deployment.

bash

# Example nginx snippet to block external access to /api/system/* until patched
location ~ ^/api/system/ {
    allow 10.0.0.0/8;       # internal management network
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}