A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, is already being actively exploited in the wild.
The flaw carries a CVSS v4 score of 9.4 and affects all FOSSBilling releases through version 0.7.2; a patch is available in version 0.8.0.
The vulnerability, identified as CWE-1336 (Improper Neutralization of Special Elements in a Template Engine), resides in FOSSBilling’s Twig template rendering pipeline.
Critical FOSSBilling SSTI Vulnerability
Because Twig templates are rendered without a sandbox, attackers can inject arbitrary expressions that gain full access to the Twig environment, application API globals, and the underlying dependency injection (DI) container.
The flaw is rooted in renderString() inside src/modules/System/Service.php, which renders arbitrary strings with no sandbox restrictions.
The string_render admin API endpoint passes user-supplied input directly to this method, and email templates follow the same vulnerable rendering path.
Most critically, the getDi() method on API handler objects returns the raw DI container exposing PDO for arbitrary SQL read/write, session manipulation services, password hashing, and the Symfony FilesystemAdapter, which can be abused for extension manifest poisoning.
Published on June 23, 2026, by researcher @admdly under GHSA-57mv-jm88-66jc, the advisory credits @0xcan1337 for responsible disclosure and PoC development.
The attack surface widens considerably when chained with GHSA-78×5-c8gw-8279, an authorization-bypass flaw in FOSSBilling that eliminates the authentication requirement entirely, allowing unauthenticated attackers to achieve full RCE with zero privileges.
A further attack vector exists through the Custom Payment Gateway adapter, where rendered template output is returned directly to invoice-paying clients, potentially enabling stored client-side script execution alongside the broader DI container abuse.
The threat actor does not appear on major honeypot platforms, indicating a targeted campaign rather than indiscriminate opportunistic scanning. The observed malicious IP is 160.30.209[.]77, operating under AS137552 (Terabix).
Critically, no public proof-of-concept exploit was known to exist at the time exploitation was first observed, suggesting a private PoC was already in circulation among threat actors before broader public awareness.
All FOSSBilling releases from version 0.1.0 through 0.7.2 are affected. The vulnerability is fully addressed in FOSSBilling 0.8.0. Operators should upgrade immediately and search the logs for activity from 160.30.209[.]77.
All email templates and mass mail campaigns should be audited for suspicious Twig expressions, and all admin and client API tokens must be rotated.
Blocking external access to /api/system/* at the reverse proxy or WAF level, it is also strongly advised to neutralize the unauthenticated attack chain with GHSA-78×5-c8gw-8279.
Given the near-zero window between disclosure and active exploitation, any unpatched FOSSBilling instance should be treated as potentially compromised until a full log review is completed.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 vulnerability in FOSSBilling, tracked as CVE-2026-28496, is already being actively exploited in the wild.){kind=link}