CVE-2026-43921: FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's Config::prettyPrintArrayToPHP() method. When configuration values are updated, string values are written into config.php without escaping single quotes. Because config.php is loaded via a bare include on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit config.php for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0 - Configuration
Ensure FOSSBilling config.php writes updated configuration string values with proper escaping for single quotes to prevent arbitrary PHP code injection via unescaped config serialization (described for Config::prettyPrintArrayToPHP() in versions 0.6.10 through 0.7.2).
FOSSBilling (config.php generation) escaping of string values when writing to config.php = escape/encode single quotes in string values before writing to config.php (instead of writing raw values) - Compensating control
Restrict access to FOSSBilling admin functionality/API endpoints that modify configuration to trusted personnel only.
- Compensating control
At the reverse proxy/WAF level, restrict access to the FOSSBilling admin API endpoints that modify configuration.
- Operational
Audit FOSSBilling config.php for unexpected/previously injected PHP code after applying the patch/upgrade.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43921?
The severity of CVE-2026-43921 is rated at risk level 60.
What type of vulnerability is CVE-2026-43921?
CVE-2026-43921 is a code injection vulnerability affecting FOSSBilling.
How do I fix CVE-2026-43921?
To fix CVE-2026-43921, you should upgrade FOSSBilling to a version later than 0.7.2.
Which versions of FOSSBilling are affected by CVE-2026-43921?
FOSSBilling versions 0.6.10 through 0.7.2 are affected by CVE-2026-43921.
What is the impact of exploiting CVE-2026-43921?
Exploiting CVE-2026-43921 allows an attacker to inject arbitrary PHP code into the configuration files.