CVE-2026-28496

CVE-2026-28496 is a Server-Side Template Injection (SSTI) vulnerability found in FOSSBilling, an open-source billing and client management system. This flaw affects all versions of FOSSBilling released prior to 0.8.0. The vulnerability arises from inadequate sandboxing within the Twig template engine, which is used for rendering templates in the system. Administrators who have access to features that render Twig templates, such as email templates, mass mail campaigns, custom payment adapters, or the `string_render` API endpoint, can exploit this vulnerability. By injecting arbitrary Twig expressions, an attacker can achieve information disclosure and remote code execution. The absence of proper template isolation allows these injected expressions to access the full Twig environment, API context, and the application's dependency injection container.