Loading vulnerability…
Unsandboxed Twig SSTI in FOSSBilling
CVE-2026-28496 is a server-side template injection vulnerability in FOSSBilling’s Twig template rendering system affecting versions prior to 0.8.0. The flaw stems from rendering attacker-controlled Twig templates without a sandbox or equivalent restrictions, including in the admin system/string_render functionality and other template-rendering features such as email templates, mass mail campaigns, and custom payment adapters. The exposed Twig context includes application objects such as the API handler and, through getDi(), the full Pimple dependency injection container. As described in the provided content, this can expose services including database access (pdo), cache, session, authentication, password hashing, extension management, and other internal components. An attacker able to inject arbitrary Twig expressions can therefore traverse application internals, disclose sensitive data, execute arbitrary SQL through exposed services, and in some exploitation paths achieve remote code execution. The issue was fixed in FOSSBilling 0.8.0 by routing rendering through a sandboxed renderer.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in disclosure of sensitive application and customer data, including administrator records, password hashes, API tokens, payment gateway secrets, invoices, transactions, hosting credentials, support data, and session-related information. Because the unsandboxed template context exposes the dependency injection container and database-related services, an attacker may also modify application state, create administrator accounts, poison cache entries used by extension-management workflows, and ultimately achieve remote code execution. In the broader chain described in the content, this vulnerability can be used for full compromise of the FOSSBilling instance and execution as the web server user.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by restricting or disabling features that render arbitrary Twig templates, especially externally reachable rendering paths. Audit and sanitize existing email templates and other stored Twig content for suspicious expressions. Block external access to /api/system/* at the reverse proxy or WAF to reduce the risk of chaining with the related authentication-bypass issue referenced in the content. Limit administrative access to template-editing features and monitor for unexpected template changes, new administrator creation, anomalous extension installation activity, and suspicious API usage.
Patch, then assume compromise.
Upgrade FOSSBilling to version 0.8.0 or later, which patches the vulnerability by replacing unsafe Twig rendering with a sandboxed renderer and associated security policy. Review all locations where user- or admin-supplied Twig templates may have been stored or rendered, including email templates, mass mail content, and custom payment adapters. Audit existing templates for malicious Twig expressions. Because the vulnerability may have exposed secrets, rotate administrator and client API tokens and any other credentials stored in or accessible from the application, including payment gateway and hosting-management credentials where appropriate.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.