CVE-2026-53641: FOSSBilling Stored XSS Vulnerability

CVE-2026-53641 Overview

CVE-2026-53641 is a stored cross-site scripting (XSS) vulnerability in FOSSBilling, a free and open-source billing and client management system. The flaw affects versions 0.6.0 through 0.7.2 and resides in the client-facing email history views. Email HTML content stored in the content_html field is rendered into a JavaScript template literal using the Twig |raw filter, which bypasses all output escaping. An attacker with administrative access can inject JavaScript payloads into email content that execute in the browser of any client viewing their email history. FOSSBilling version 0.8.0 contains the fix. The vulnerability is tracked as CWE-79.

Critical Impact
An authenticated admin can plant persistent JavaScript in client email history views, enabling session theft, account takeover, or targeted phishing against client accounts.

Affected Products

FOSSBilling 0.6.0 through 0.7.2
Client-facing email history view components
Deployments where the admin account is not fully trusted or is exposed to compromise

Discovery Timeline

2026-07-06 - CVE-2026-53641 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-53641

Vulnerability Analysis

The vulnerability is a stored XSS flaw in FOSSBilling's client-facing email history interface. FOSSBilling stores outgoing email content in the database, including the rendered HTML body in a content_html field. When a client views their email history, the template layer injects this HTML into a JavaScript template literal on the page. Because the template uses the |raw filter, Twig performs no HTML or JavaScript escaping on the value. Any script content stored in content_html is executed by the client's browser in the FOSSBilling origin context.

Exploitation requires an attacker with admin-level access to inject payloads into email content. Once stored, the payload persists and executes for every client who opens the affected email in their history view. Because execution occurs in the client's authenticated session, an attacker can steal session cookies, perform actions on behalf of the client, or pivot to phishing workflows within the billing portal.

Root Cause

The root cause is the use of the Twig |raw filter on untrusted email HTML content that is inlined into a JavaScript template literal. The |raw filter is intended for pre-sanitized, trusted markup and disables Twig's default auto-escaping. Combined with insertion inside a JavaScript context, standard HTML-only escaping would still be insufficient — the value requires JavaScript string escaping in addition to HTML output encoding.

Attack Vector

The attack path requires a network-reachable FOSSBilling instance and privileged admin access to author or modify email content stored in the database. The attacker crafts an email containing a JavaScript payload embedded in the HTML body. When any client subsequently loads their email history view, the payload executes under the client's session. Exploitation depends on user interaction, since a client must navigate to the affected view. The vulnerability does not disclose or modify server-side data directly but enables lateral impact against client accounts.

Refer to the FOSSBilling GitHub Security Advisory GHSA-q6c8-6r72-35f7 for the vendor's technical description.

Detection Methods for CVE-2026-53641

Indicators of Compromise

Email records in the FOSSBilling database whose content_html field contains <script> tags, event handler attributes such as onerror or onload, or javascript: URIs.
HTML template literal fragments, backticks, or ${...} sequences inside stored email bodies that could break out of the JavaScript string context.
Unexpected outbound requests from client browsers to attacker-controlled domains shortly after loading the email history page.

Detection Strategies

Query the email storage table for suspicious substrings in content_html, including <script, onerror=, onload=, javascript:, and backtick or ${ occurrences.
Review admin audit logs for email creation or modification events by accounts that do not normally send email content.
Inspect web server and application logs for anomalous client sessions loading /client email history endpoints followed by outbound cross-origin requests.

Monitoring Recommendations

Enable a strict Content Security Policy (CSP) and monitor report-uri or report-to endpoints for violations originating from the client email history view.
Alert on admin account logins from new IP addresses, new user agents, or outside business hours.
Track client-side JavaScript errors and unexpected DOM mutations on the email history page through browser telemetry or RUM tooling.

How to Mitigate CVE-2026-53641

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which contains the official fix.
Audit the email database table for suspicious content_html values and delete or sanitize any entries containing script payloads.
Rotate admin credentials and enforce multi-factor authentication on all administrative accounts.

Patch Information

FOSSBilling version 0.8.0 contains the fix for CVE-2026-53641. The maintainers recommend upgrading to this release. Full remediation details are available in the GitHub Security Advisory GHSA-q6c8-6r72-35f7.

Workarounds

Restrict admin panel access to trusted IP ranges and reduce the number of accounts with admin privileges.
Audit stored email content in the database for suspicious HTML or JavaScript payloads and remove offending records.
Monitor client accounts for unusual activity such as unexpected profile changes, order actions, or session anomalies.
Deploy a strict Content Security Policy that blocks inline scripts and disallows execution from untrusted origins as defense-in-depth.

bash

# Example: audit stored email content for likely XSS payloads
mysql -u fossbilling -p fossbilling -e \
  "SELECT id, client_id, subject FROM extension_meta_mod_email \
   WHERE content_html REGEXP '<script|onerror=|onload=|javascript:|\\${';"