CVE-2026-43921: Fossbilling

High severity, CVSS 8.9. EPSS: 0.4% chance of exploitation in the next 30 days.

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.

Affected products

• Fossbilling Fossbilling: from 0.6.10, before 0.8.0 (fixed in 0.8.0)

Published 2026-07-06. Last modified 2026-07-07.