Unsandboxed Twig SSTI in FOSSBilling
CVE-2026-28496 is a server-side template injection vulnerability in FOSSBilling's Twig template rendering system affecting versions prior to 0.8.0. Twig templates were rendered without a sandbox, exposing the full Twig environment, API context, and the application's dependency injection container. In practice, an attacker able to supply Twig expressions through template-rendering features such as email templates, mass mail campaigns, custom payment adapters, or the string_render API endpoint can execute arbitrary Twig expressions. The exposed context includes an Api_Handler object implementing InjectionAwareInterface; its getDi() method returns the full Pimple DI container, enabling access to sensitive services such as database, cache, session, authentication, password hashing, extension management, and updater components. This can result in information disclosure and, depending on reachable services and chaining, remote code execution. The issue was fixed in FOSSBilling 0.8.0 by replacing the unsafe renderer with a sandboxed Twig renderer backed by a Twig SecurityPolicy.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
/api/system/* at the reverse proxy or WAF to reduce chaining risk with GHSA-78x5-c8gw-8279 / CVE-2026-27604. Restrict access to administrative features that can render Twig templates, review installed custom payment adapters and modules, and monitor for unexpected extension installation activity or template changes.Remediation
Patch, then assume compromise.
string_render behavior with a sandboxed Twig renderer enforced by a Twig SecurityPolicy. Because exploitation may expose credentials and tokens, administrators should also audit existing templates and related rendered content for malicious Twig expressions, review for unauthorized administrator creation or module installation, and rotate all admin and client API tokens after patching.Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical server-side template injection vulnerability in FOSSBilling's Twig template rendering that can allow information disclosure and remote code execution in versions prior to 0.8.0.
An unsandboxed Twig server-side template injection vulnerability in FOSSBilling's string_render functionality that exposes the DI container and can be escalated to remote code execution, especially when chained with the auth bypass.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.