CVE-2026-43921: FOSSBilling PHP Code Injection Vulnerability

CVE-2026-43921 Overview

CVE-2026-43921 is a PHP code injection vulnerability [CWE-94] in FOSSBilling, an open-source billing and client management system. The flaw exists in the Config::prettyPrintArrayToPHP() method across versions 0.6.10 through 0.7.2. String configuration values are written to config.php without escaping single quotes. Because config.php is loaded via a bare include on every HTTP request, an authenticated administrator can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains the fix.

Critical Impact
Authenticated administrators can persist arbitrary PHP code inside config.php, gaining reliable remote code execution on the web server across all subsequent HTTP requests.

Affected Products

FOSSBilling 0.6.10 through 0.7.2
FOSSBilling deployments exposing the admin API to untrusted networks
Any FOSSBilling instance where administrator credentials may be compromised

Discovery Timeline

2026-07-06 - CVE-2026-43921 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-43921

Vulnerability Analysis

The vulnerability resides in FOSSBilling's configuration persistence layer. The Config::prettyPrintArrayToPHP() method serializes configuration arrays into valid PHP syntax and writes the result to config.php. String values are wrapped in single quotes but not sanitized. Any single quote inside a user-controlled value terminates the PHP string literal early, allowing the attacker to append arbitrary PHP code before the following delimiter.

FOSSBilling loads config.php via a bare include statement at the top of every HTTP request. The injected payload therefore executes in the context of the web server process on every request until the file is repaired. This yields persistent remote code execution rather than a one-shot payload.

Root Cause

The root cause is missing output encoding when generating PHP source code from user-supplied input. The serializer treats configuration values as trusted strings and concatenates them directly into single-quoted PHP literals. Special characters such as ' and \ are not escaped, breaking the invariant that generated code matches the intended array structure. This maps to CWE-94, Improper Control of Generation of Code.

Attack Vector

An attacker must first authenticate as an administrator, either by using compromised credentials or by pivoting from another privilege escalation. The attacker then submits a configuration update through the admin API where a string field contains a single quote followed by PHP code. When FOSSBilling regenerates config.php, the injected code becomes part of the file. Every subsequent HTTP request evaluates the payload during the include call, giving the attacker webshell-equivalent access.

The vulnerability requires no user interaction and is exploitable over the network once administrative access is available. See the GitHub Security Advisory GHSA-v4j9-w6pj-38w5 for the maintainer's technical details.

Detection Methods for CVE-2026-43921

Indicators of Compromise

Unexpected PHP statements, function calls, or eval/system/passthru invocations inside config.php
Configuration string values containing unescaped single quotes, semicolons, or PHP tags
Web server processes spawning shells, curl, wget, or other command-line utilities from the FOSSBilling directory
Outbound network connections from the FOSSBilling host to attacker-controlled infrastructure

Detection Strategies

Perform integrity monitoring on config.php and alert on any modification outside of expected admin workflows
Diff the current config.php against a known-good baseline and flag content that is not a pure array literal
Review admin API audit logs for configuration update calls that contain quote characters or PHP syntax in payloads
Hunt for anomalous child processes of the PHP-FPM or web server user account

Monitoring Recommendations

Enable verbose logging on FOSSBilling admin endpoints that modify configuration state
Forward web server, PHP, and host process telemetry to a centralized data lake for correlation
Alert on new administrator logins from unfamiliar IP addresses or geolocations
Track file modification timestamps on all PHP files in the FOSSBilling installation directory

How to Mitigate CVE-2026-43921

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0, which contains the patch for Config::prettyPrintArrayToPHP()
Audit config.php for any injected PHP code and restore from a trusted backup if tampering is found
Rotate all administrator credentials and API tokens that could have been used to reach the admin API
Review admin account membership and remove accounts that are no longer required

Patch Information

The maintainers fixed the issue in FOSSBilling 0.8.0. Administrators running any version from 0.6.10 through 0.7.2 should upgrade immediately. Details are available in the FOSSBilling GitHub Security Advisory.

Workarounds

Restrict administrator access to trusted personnel and enforce strong authentication on admin accounts
Audit config.php regularly for unexpected PHP code and file modification events
Use a reverse proxy or WAF to restrict access to admin API endpoints that modify configuration to known management IP ranges
Place the FOSSBilling admin interface behind a VPN or IP allowlist until the upgrade to 0.8.0 is complete

bash

# Example nginx snippet restricting admin API endpoints to a management network
location /api/admin/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://fossbilling_backend;
}