CVE-2026-33734: FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the Massmailer module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the Massmailer module if it is not required, audit existing records in the modmassmailer table for suspicious filter values, and/or review administrator activity related to Massmailer message updates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBilling Massmailerto a version that resolves this vulnerability.Fixed in 0.8.0 - Configuration
Disable the Massmailer module if it is not required.
FOSSBilling Massmailer module Massmailer module enabled = false - Compensating control
Restrict administrator access to trusted users only.
- Operational
Audit existing records in the mod_massmailer table for suspicious filter values.
- Operational
Review administrator activity related to Massmailer message updates.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33734?
CVE-2026-33734 has a medium severity rating of 6.9 based on its CVSS score.
How do I fix CVE-2026-33734?
To fix CVE-2026-33734, upgrade FOSSBilling to a version later than 0.7.2 where the vulnerability has been patched.
What category does CVE-2026-33734 fall under?
CVE-2026-33734 falls under the category of SQL Injection vulnerabilities.
Who can exploit CVE-2026-33734?
An authenticated administrator can exploit CVE-2026-33734 by supplying crafted filter values in the `Massmailer` module.
In which versions of FOSSBilling is CVE-2026-33734 present?
CVE-2026-33734 is present in FOSSBilling versions 0.6.0 through 0.7.2.