CVE-2026-53641
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
FOSSBilling versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in client-facing email history views. Email HTML content is rendered into a JavaScript template literal without proper escaping, allowing an attacker with admin access to inject malicious JavaScript payloads.
Risk Assessment
An attacker with admin privileges can inject malicious JavaScript into email content that executes in the browser of any client viewing their email history. This could lead to session theft, data leakage, or further attacks on clients.
Recommendation
Upgrade FOSSBilling to version 0.8.0 immediately, which contains the fix. Until then, restrict admin account access, audit email content in the database for suspicious payloads, and monitor client accounts for unusual activity.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript template literal using the `|raw` filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity.