Vulnerability · Published Jul 6, 2026 · Assigned by GitHub_M
CVE-2026-43921FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
High 8.9
In plain English
A high-severity code injection in FOSSBilling from FOSSBilling. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FOSSBilling | FOSSBilling | >= 0.6.10, < 0.8.0 |
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H