CVE-2026-40495 Overview
CVE-2026-40495 is an information disclosure vulnerability in FOSSBilling, an open-source billing and client management system. Versions prior to 0.8.0 leak the exact system version through asset cache buster query parameters embedded in HTML output. The version appears in every <script> and <link> tag generated by the script_tag and stylesheet_tag Twig filters. This disclosure bypasses the hide_version_public security setting, which administrators rely on to conceal installation details from unauthenticated visitors. While the X-FOSSBilling-Version HTTP header and the guest.system.version API endpoint honour that setting, the asset cache buster parameters were overlooked during implementation.
Critical Impact
Unauthenticated remote attackers can fingerprint the exact FOSSBilling version from any rendered page, enabling targeted exploitation of version-specific vulnerabilities.
Affected Products
- FOSSBilling versions prior to 0.8.0
- FOSSBilling installations with hide_version_public enabled (setting is bypassed)
- All public-facing FOSSBilling deployments serving unauthenticated guests
Discovery Timeline
- 2026-06-03 - CVE-2026-40495 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-40495
Vulnerability Analysis
The vulnerability stems from inconsistent application of the hide_version_public configuration setting across FOSSBilling's output channels. Administrators enable this setting to suppress version information from public surfaces, reducing reconnaissance value for attackers. The HTTP response header and the public API endpoint correctly honour the setting. However, the Twig template filters responsible for generating asset references append the FOSSBilling version as a cache buster query parameter on every <script> and <link> tag.
Because these tags are emitted on every rendered HTML page, the version is exposed to all visitors regardless of authentication state. An attacker can issue a single unauthenticated HTTP GET request to any public page and parse the version string from the asset URLs. Knowledge of the exact version simplifies the process of matching the installation against known [CWE-200] information exposure issues and version-specific exploits. The disclosure undermines the defence-in-depth posture that hide_version_public is intended to provide.
Root Cause
The script_tag and stylesheet_tag Twig filters embed the FOSSBilling version into asset query strings for cache invalidation purposes. The implementation does not consult the hide_version_public setting before appending the version. This logic gap diverges from the behaviour applied to the X-FOSSBilling-Version header and the guest.system.version API response.
Attack Vector
Exploitation requires no authentication, no user interaction, and only network access to the target. An attacker fetches any HTML page served by the FOSSBilling instance and extracts the version token from src or href query parameters on script and stylesheet tags. The harvested version can then be cross-referenced against public vulnerability databases to identify applicable exploits. The vulnerability is referenced in the GitHub Security Advisory GHSA-gqcp-g7rm-p5v6.
Detection Methods for CVE-2026-40495
Indicators of Compromise
- HTTP requests to public FOSSBilling pages from unfamiliar IPs followed by requests targeting version-specific exploit paths
- Repeated unauthenticated GETs to root or login pages with no follow-up asset retrieval, suggesting HTML scraping for fingerprinting
- Web server access logs showing automated tooling user agents fetching only HTML responses
Detection Strategies
- Inspect rendered HTML from the FOSSBilling instance for version strings in <script src="...?v=X.Y.Z"> and <link href="...?v=X.Y.Z"> patterns
- Compare the version disclosed in asset URLs against the X-FOSSBilling-Version header response to confirm exposure
- Audit web application firewall logs for scanners querying common billing platform fingerprints
Monitoring Recommendations
- Log and review unauthenticated traffic patterns on the FOSSBilling front end, focusing on reconnaissance-style request sequences
- Alert on subsequent exploitation attempts targeting endpoints known to be vulnerable in the disclosed version
- Track upgrade compliance to ensure all FOSSBilling deployments are running version 0.8.0 or later
How to Mitigate CVE-2026-40495
Immediate Actions Required
- Upgrade FOSSBilling to version 0.8.0 or later, which contains the patch for this disclosure
- Inventory all FOSSBilling instances exposed to the internet and prioritise patching of public-facing deployments
- Review historical access logs for reconnaissance activity that may have collected the version string prior to remediation
Patch Information
FOSSBilling version 0.8.0 contains the fix. The patched release is available from the FOSSBilling 0.8.0 GitHub Release. Details on the corrected behaviour are documented in the GitHub Security Advisory GHSA-gqcp-g7rm-p5v6.
Workarounds
- No practical workaround exists that removes the version from asset URLs without modifying source code
- Operators unable to upgrade immediately should place the FOSSBilling instance behind a reverse proxy that strips or rewrites version query parameters from asset URLs
- Restrict exposure of unauthenticated pages to trusted networks until the upgrade can be applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
