CVE-2026-43921 – FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

CVE ID :CVE-2026-43921

Published : July 6, 2026, 9:38 p.m. | 9 minutes ago

Description :FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling’s `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…