Vulnerability · Published Jul 6, 2026 · Assigned by GitHub_M
CVE-2026-53641FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
Medium 4.8
In plain English
A medium-severity cross-site scripting in FOSSBilling from FOSSBilling. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript template literal using the `|raw` filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FOSSBilling | FOSSBilling | >= 0.6.0, < 0.8.0 |
Weakness: CWE-79, CWE-838 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N