CVE-2026-43921
HighCVSS 8.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
FOSSBilling versions 0.6.10 through 0.7.2 contain a PHP code injection vulnerability in the Config::prettyPrintArrayToPHP() method. An attacker with admin privileges can inject arbitrary PHP code into config.php, which is executed on every HTTP request.
Risk Assessment
The risk involves potential system takeover by a privileged attacker, leading to data theft, configuration changes, or further compromise within the infrastructure.
Recommendation
Immediately upgrade to version 0.8.0. If not possible, restrict admin access to trusted personnel, audit config.php for unexpected code, and block access to configuration-modifying API endpoints at the reverse proxy/WAF level.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.