Loading vulnerability…
CVE-2026-28496 is a server-side template injection vulnerability in FOSSBilling’s Twig template rendering system affecting versions prior to 0.8.0. The flaw stems from rendering attacker-controlled Twig templates without a sandbox or equivalent restrictions, including in the admin system/string_render functionality and other template-rendering features such as email templates, mass mail campaigns, and custom payment adapters. The exposed Twig context includes application objects such as the API handler and, through getDi(), the full Pimple dependency injection container. As described in the provided content, this can expose services including database access (pdo), cache, session, authentication, password hashing, extension management, and other internal components. An attacker able to inject arbitrary Twig expressions can therefore traverse application internals, disclose sensitive data, execute arbitrary SQL through exposed services, and in some exploitation paths achieve remote code execution. The issue was fixed in FOSSBilling 0.8.0 by routing rendering through a sandboxed renderer.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
/api/system/* at the reverse proxy or WAF to reduce the risk of chaining with the related authentication-bypass issue referenced in the content. Limit administrative access to template-editing features and monitor for unexpected template changes, new administrator creation, anomalous extension installation activity, and suspicious API usage.Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a small local Docker lab and proof-of-concept for CVE-2026-28496, a FOSSBilling server-side template injection issue in Twig rendering. The repo contains 7 files: documentation (README.md), orchestration (docker-compose.yml), two Dockerfiles for vulnerable and patched images, a Python PoC (poc/poc.py), and a Bash auto-installer (scripts/auto-install.sh). The main exploit capability is HTTP-based SSTI validation against the FOSSBilling API endpoint /api/system/system/string_render. The Python PoC sends a POST request with JSON payload {"_tpl":"{{ 7*7 }}"}. If the target is vulnerable, the server evaluates the Twig expression and returns result '49'. If patched or otherwise not exposing the behavior, the script reports an error-based non-vulnerable/not-reachable verdict. This is exploit-like validation of a real vulnerability, but it stops at harmless expression evaluation and does not include an RCE chain, shell, persistence, or post-exploitation logic. Repository structure and purpose: - poc/poc.py: primary exploit/validation script. Uses urllib only, accepts --url or interactive target selection, constructs the endpoint URL, performs the POST, parses JSON, and prints a vulnerability verdict. - scripts/auto-install.sh: helper script used by Docker sidecar containers to wait for FOSSBilling readiness, detect whether installation is needed, submit the installer form, and verify completion by probing the same API path. - docker-compose.yml: defines two FOSSBilling services (vuln 0.7.2 on 8081 and patched 0.8.0 on 8082), two MariaDB backends, and two installer sidecars. - vuln/Dockerfile and patched/Dockerfile: thin wrappers around official fossbilling/fossbilling images for versions 0.7.2 and 0.8.0. - README.md: extensive lab documentation, expected responses, safety boundaries, and references. Attack surface is clearly web/HTTP. The exploit targets unauthenticated access to the string_render API path. Fingerprintable indicators include localhost URLs, internal Docker service names (http://vuln and http://patched), installer paths under /install/install.php, and the vulnerable API path. Overall, this is a legitimate PoC/lab repository for reproducing and comparing vulnerable versus patched behavior, not a weaponized exploit kit.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A server-side template injection vulnerability in FOSSBilling's string_render API combined with exposure of the dependency injection container via getDi(), enabling arbitrary SQL execution, cache poisoning, malicious extension installation, and remote code execution when chained with the auth bypass.
The content only references CVE-2026-28496 in a pull request/conversation context and provides no technical details about the vulnerability itself.
A critical server-side template injection vulnerability in FOSSBilling's Twig template rendering that can allow information disclosure and remote code execution in versions prior to 0.8.0.
An unsandboxed Twig server-side template injection vulnerability in FOSSBilling's string_render functionality that exposes the DI container and can be escalated to remote code execution, especially when chained with the auth bypass.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.