CVE-2026-43921 PUBLISHED

FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

Assigner: GitHub_M
Reserved: 04.05.2026 Published: 06.07.2026 Updated: 07.07.2026

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's Config::prettyPrintArrayToPHP() method. When configuration values are updated, string values are written into config.php without escaping single quotes. Because config.php is loaded via a bare include on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit config.php for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 8.9

Product Status

Vendor FOSSBilling
Product FOSSBilling
Versions
  • Version >= 0.6.10, < 0.8.0 is affected

References

Problem Types

  • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE