Exploitation ongoing with high activity in latest observed window (6 mentions)
Recommended action window: Immediate (within 24h)
NVD description
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the `string_render` API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container. Version 0.8.0 patches the issue. Some workarounds are available. Audit existing email templates for suspicious Twig expressions, rotate all admin and client API tokens, and/or block external access to /api/system/* at reverse proxy/WAF to mitigate chaining with GHSA-78x5-c8gw-8279.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
RISING
| Date | Total | Labels |
|---|
| 2026-06-21 | 1 | Disclosure1 |
| 2026-06-22 | 1 | Disclosure1 |
| 2026-06-23 | 2 | Disclosure2 |
| 2026-06-24 | 1 | Disclosure1 |
| 2026-06-25 | 2 | Active Exploitation1Disclosure1 |
| 2026-06-26 | 1 | Active Exploitation1 |
| 2026-06-29 | 1 | Active Exploitation1 |
| 2026-07-13 | 4 | Disclosure4 |
| 2026-07-17 | 6 | Active Exploitation6 |
#CVE-2026-28496: SSTI in #FOSSBilling Twig templates may escalate to SQLi or even RCE when FILE privileges are enabled. https://t.co/zq55LadbTG
Post summary
A new CVE-2026-28496 involving SSTI that can lead to SQLi or RCE in FOSSBilling with FILE privileges is disclosed, with no PoC, exploit, patch, or active exploitation evidence presented.
My new CVE, CVE-2026-28496 has been published and assigned a CVSS score of 9.4 (Critical). I identified a Server-Side Template Injection (SSTI) vulnerability in the Twig template rendering functionality of FOSSBilling. Advisory: https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc
Post summary
A new critical CVE-2026-28496 was disclosed for FOSSBilling's Twig template rendering, identified as an SSTI vulnerability with a CVSS score of 9.4, and an advisory link was provided.
🚨 Yesterday we observed CVE-2026-28496 (FOSSBilling Template Injection vulnerability CVSS 9.4) being exploited We do not operate a FOSSBilling honeypot - however, this actor does not appear on other major honeypot platforms making it a potentially targeted campaign. Additionally, CVE-2026-28496 is not known to be exploited, nor to have a public POC exploit. The vulnerability details were published June 23nd and the exploit activity was recorded early on the next day. If you operate a FOSSBilling instance, patch immediately and search logs for activity from 160.30.209[.]77 (AS137552 Terabix 🇲🇾)
Post summary
Active exploitation of CVE‑2026‑28496 against FOSSBilling was observed; administrators are advised to patch immediately and investigate logs for activity from 160.30.209.77.
🚨 New critical flaw in FOSSBilling: CVE-2026-28496! An unsandboxed Twig engine combined with an auth bypass leads directly to Unauthenticated RCE. Read my full technical deep dive, PoC request/response, and remediation steps here: 👇 Read More https://denizhalil.com/2026/06/25/fossbilling-ssti-vulnerability-cve-2026-28496/ https://t.co/6h47VTq1cA
Post summary
A new critical vulnerability (CVE‑2026‑28496) in FOSSBilling is disclosed, enabling unauthenticated RCE via an unsandboxed Twig engine and auth bypass. The post links to PoC code and remediation steps.
A FOSSBilling template injection flaw (CVE-2026-28496, CVSS 9.4) is exploited in the wild. Patch to 0.8.0 now to stop server-side template injection. #FOSSBilling #SSTI #RCE #TemplateInjection #CyberSecurity https://securityonline.info/fossbilling-template-injection-exploited https://t.co/QSUYoH2BWW
Post summary
CVE-2026-28496, a severe server‑side template injection flaw in FOSSBilling, is actively being exploited in the wild and a patch (0.8.0) is now available.
🚨 CVE-2026-28496 - critical 🚨 FOSSBilling - Server-Side Template Injection > A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's templat... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-28496 @pdnuclei #NucleiTemplates #cve
Post summary
A newly disclosed critical SSTI vulnerability (CVE‑2026‑28496) in FOSSBilling is announced, with a link to a Nuclei template entry.
Source: X search for PoC exploit 2026 Posted: 2026-06-25T11:17:17.000Z Likes: 20 0day Intel: 🚨 Yesterday we observed CVE-2026-28496 (FOSSBilling Template Injection vulnerab
Post summary
The post reports that CVE-2026-28496, a Template Injection vulnerability in FOSSBilling, was observed in the wild; no PoC, exploit code, patch, or false‑positive claim is provided.
Full Tweet 🚨 Yesterday we observed CVE-2026-28496 (FOSSBilling Template Injection vulnerability CVSS 9.4) being exploited 0day Intel: 🚨 Yesterday we observed CVE-2026-28496 (FOSSBilling Template Injection vulnerab
Post summary
The tweet confirms real‑time exploitation of CVE‑2026‑28496 in the wild, highlighting an immediate threat despite lacking PoC or patch details.
CVE-2026-28496: 🚨 Yesterday we observed CVE-2026-28496 (FOSSBilling Template Injection vulnerability CVSS 9.4) being exploited We do not operate a FOSSBilling honeypot - however, this actor does not appear on other major honeypot platforms making it a potentially targeted…
Post summary
CVE‑2026‑28496, a high‑CVSS FOSSBilling template injection flaw, is actively being exploited, yet no PoC, exploit code, or patch information is disclosed.
0day Intel: 🚨 Yesterday we observed CVE-2026-28496 (FOSSBilling Template Injection vulnerab
Post summary
The post reports that CVE-2026-28496—a Template Injection issue in FOSSBilling—was observed in the wild; no patches or PoC details are provided.
Vendor v9.4. 0day Intel: 🚨 Yesterday we observed CVE-2026-28496 (FOSSBilling Template Injection vulnerab
Post summary
The post reports that CVE‑2026‑28496, a template‑injection flaw in FOSSBilling, was seen in active use yesterday, indicating real‑world exploitation.
CVE-2026-28496. 0day Intel: 🚨 Yesterday we observed CVE-2026-28496 (FOSSBilling Template Injection vulnerab
Post summary
CVE-2026-28496, a Template Injection flaw in FOSSBilling, was observed in active exploit use yesterday, with no patch or PoC disclosed.
Source: X search for vulnerability critical 2026 Posted: 2026-06-21T15:52:43.000Z Likes: 16 0day Intel: My new CVE, CVE-2026-28496 has been published and assigned a CVSS score of 9.4 (
Post summary
A new vulnerability, CVE-2026-28496, has been announced with a high CVSS score of 9.4, but no exploitation details, PoC, or mitigation measures are disclosed.
Full Tweet My new CVE, CVE-2026-28496 has been published and assigned a CVSS score of 9.4 (Critical). 0day Intel: My new CVE, CVE-2026-28496 has been published and assigned a CVSS score of 9.4 (
Post summary
The author announces a newly disclosed CVE-2026-28496, noting its critical CVSS score of 9.4, but offers no additional details.
CVE-2026-28496: My new CVE, CVE-2026-28496 has been published and assigned a CVSS score of 9.4 (Critical). I identified a Server-Side Template Injection (SSTI) vulnerability in the Twig template rendering functionality of FOSSBilling. Advisory: (9.4)
Post summary
The post announces a new CVE for FOSSBilling with a critical score, detailing an SSTI vulnerability in its Twig template system.
0day Intel: My new CVE, CVE-2026-28496 has been published and assigned a CVSS score of 9.4 (
Post summary
A newly disclosed CVE-2026-28496 is mentioned with a high CVSS score of 9.4, but no exploitation or mitigation details are provided.
It is possible to see elevated activities targeting FOSSBilling (CVE-2026-28496) https://vuldb.com/vuln/372912/cti
Post summary
The post indicates that there are increased malicious activities targeting FOSSBilling related to CVE‑2026‑28496, but provides no PoC, exploit code, or patch details.
🚨 Critical - FOSSBilling Server-Side Template Injection → RCE (CVE-2026-28496) FOSSBilling renders Twig templates without a sandbox, so an authenticated admin can inject arbitrary Twig expressions through email templates, mass-mail campaigns, custom payment adapters, or the `string_render` API endpoint — reaching the full Twig environment and the app's DI container for information disclosure and remote code execution (CVSS 9.4). 👉 Affected: FOSSBilling < 0.8.0 | Upgrade to 0.8.0 — or audit templates, rotate admin/client API tokens, and block `/api/system/*` at the WAF
Post summary
The post announces the discovery of a server‑side template injection that allows authenticated admins to achieve remote code execution in FOSSBilling, provides the CVSS score, and recommends upgrading to version 0.8.0 or applying basic mitigations.
CVE-2026-28496 Server-side template injection in Twig template rendering enables information disclosure and RCE · Advisory · FOSSBilling/FOSSBilling · GitHub https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc
Post summary
A GitHub advisory for CVE-2026-28496 reports a server‑side template injection in Twig that allows information disclosure and remote code execution, with no PoC, exploit code, or evidence of active exploitation mentioned.