CVE-2026-53641: FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (contenthtml) is rendered into a JavaScript template literal using the |raw filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0 - Compensating control
Restrict admin account access to prevent attackers from injecting malicious JavaScript payloads into email content.
- Compensating control
Monitor client accounts for unusual activity that may indicate exploitation of the stored XSS in email history views.
- Operational
Audit email content stored in the FOSSBilling database for suspicious payloads (malicious JavaScript) in the client email history views.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53641?
CVE-2026-53641 has a risk rating of 45, indicating a moderate level of severity.
How do I fix CVE-2026-53641?
To fix CVE-2026-53641, update FOSSBilling to a version newer than 0.7.2 where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-53641?
CVE-2026-53641 is a stored cross-site scripting (XSS) vulnerability.
Which versions of FOSSBilling are affected by CVE-2026-53641?
FOSSBilling versions 0.6.0 through 0.7.2 are affected by CVE-2026-53641.
In which component does CVE-2026-53641 exist?
CVE-2026-53641 exists in the client-facing email history views of FOSSBilling.