CVE-2026-28496: FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

Synopsis

Server-side template injection (SSTI) is a class of vulnerability where an attacker can embed executable code inside a template that the server then runs. In FOSSBilling versions before 0.8.0, any administrator who can edit Twig templates (email templates, mass mail campaigns, custom payment adapters, or the string_render API endpoint) can inject arbitrary Twig expressions that execute without sandboxing, exposing the full application environment and dependency injection container. Successful exploitation gives the attacker both read access to sensitive application data and the ability to execute arbitrary code on the server. No upstream fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment upstream ships a release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FOSSBilling application over the network; the service must be exposed to the attacker's network to be exploited.

• AuthenticationRequired

  The attacker must hold a valid administrator account; a high-privilege credential is required before any template injection can be attempted.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker submits malicious input directly to the application.

• Attack complexityDetail

  Attack complexity is low, meaning no race conditions or special environmental factors are required and the exploit is reliable once the attacker has admin credentials.

Blast Radius

• Reads sensitive application data including API tokens, client records, and the contents of the dependency injection container.
• Executes arbitrary operating system commands on the server hosting FOSSBilling, resulting in full remote code execution.
• Modifies or deletes persisted billing records, client accounts, and application configuration.
• Disrupts service availability by crashing or reconfiguring the application from within the server process.