Unsandboxed Twig SSTI in FOSSBilling
CVE-2026-28496 is a server-side template injection vulnerability in FOSSBilling's Twig template rendering system affecting versions prior to 0.8.0. Twig templates rendered through administrator-accessible features—including email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint—were processed without a sandbox. As a result, an attacker able to supply Twig expressions could access the full Twig environment, the API context, and the application's dependency injection container. The exposed context included an Api_Handler object via the guest global, and Api_Handler::getDi() returned the full Pimple DI container, exposing services such as database access, cache, authentication, session, password hashing, Twig, and extension management. This unsafe rendering path enabled arbitrary Twig expression injection that could be leveraged for sensitive data disclosure and, in practical exploit chains, remote code execution.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
/api/system/* at the reverse proxy or WAF to reduce exposure and chaining risk with GHSA-78x5-c8gw-8279 / CVE-2026-27604. These are compensating controls only and do not fully eliminate the underlying SSTI risk in affected versions.Remediation
Patch, then assume compromise.
/api/system/*. After patching, review and clean existing templates and related configuration for malicious Twig payloads that may have been persisted prior to remediation.Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical server-side template injection vulnerability in FOSSBilling's Twig template rendering that can allow information disclosure and remote code execution in versions prior to 0.8.0.
An unsandboxed Twig server-side template injection vulnerability in FOSSBilling's string_render functionality that exposes the DI container and can be escalated to remote code execution, especially when chained with the auth bypass.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.