CVE-2026-40495

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login). checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation, allowing remote attackers to force authentication.

FOSSBilling from 0.1.0 until 0.8.7 has a path traversal vulnerability in the unauthenticated api/guest/system/template_exists endpoint because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or verifying the resolved path stays inside the active theme directory. An attacker can determine whether arbitrary files or directories exist on the server.

In FOSSBilling from 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules, skipping access checks. A low-privileged staff account can read decrypted extension secrets and overwrite stored configuration of a deactivated module.

FOSSBilling versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability. An attacker can mark any unpaid invoice as paid and credit the client account by sending a single crafted HTTP request to the IPN callback endpoint.

FOSSBilling versions 0.7.2 and prior have a vulnerability in the guest API that allows the creation of new administrator accounts even when one already exists. A flaw in the admin existence check enables an attacker to bypass protections.

FOSSBilling prior to version 0.8.0 has a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators can inject arbitrary Twig expressions, leading to information disclosure and remote code execution.

FOSSBilling versions 0.5.4 to 0.8.0 have an authorization bypass in API role handling, allowing unauthenticated access to privileged `/api/system/*` endpoints. Attackers can invoke admin API methods without valid credentials.

FOSSBilling from 0.1.0 until 0.8.7 has an unauthenticated POST /api/guest/client/create endpoint that reveals whether a submitted email belongs to a registered client by returning a distinct unredacted error. An attacker can compare responses to determine if an email belongs to an existing client.

In FOSSBilling prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived path (MD5 hash). Two different products or order files with the same original filename overwrite each other, causing customers or administrators to receive the wrong file.