FOSSBilling Flaw Lets Admin Attackers Abuse DI Container for SQL Access and RCE

Gbhackers •Divya • June 26, 2026

A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, is exposing instances to potential full database compromise and remote code execution (RCE), with early signs of active exploitation appearing shortly after public disclosure. This flaw is documented under GitHub advisory GHSA-57mv-jm88-66jc and affects all versions up to 0.7.2. It has been patched […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SSTI Vulnerability in FOSSBilling Exposes Databases to RCE Attacks A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, was disclosed on June 23, 2026. This flaw affects all versions up to 0.7.2 and allows attackers to exploit unsafe Twig template rendering, leading to full database compromise and remote code execution (RCE). The vulnerability can be exploited by both administrative users and unauthenticated attackers, particularly through features like email templates and the `string_render` API endpoint. The internal dependency injection (DI) container is also exposed, enabling attackers to perform arbitrary read/write operations on the database and hijack sessions. Threat intelligence indicates that exploitation attempts began within 24 hours of disclosure, highlighting the urgency of the situation. The flaw has a CVSS v4 score of 9.4, indicating a high impact on confidentiality, integrity, and availability. A patch was released in version 0.8.0, but the risk remains significant due to ongoing exploitation attempts. 2 sources 78

Extracted Entities

FOSSBilling Flaw Lets Admin Attackers Abuse DI Container for SQL Access and RCE

The full story

Extracted Entities

Attack Types (2)

CVEs (1)

CWE Weaknesses (2)