Which versions of FOSSBilling are affected by CVE-2026-43921?

FOSSBilling versions 0.6.10 through 0.7.2 contain a code injection vulnerability allowing administrator-privileged users to inject arbitrary PHP code into system configuration, resulting in…. A patch is available.

How to fix or mitigate CVE-2026-43921?

Within 24 hours: Audit all administrator login activity and configuration modifications from the past 90 days; if any suspicious changes to config.php or system settings are detected, immediately terminate all active sessions for affected accounts and rotate all service credentials. Within 7 days: Enforce multi-factor authentication on all administrator accounts, implement file integrity monitoring on config.php with real-time alerts, and restrict administrative UI access to hardened networks or specific IP ranges. Within 30 days: Monitor vendor advisories weekly for patched versions of FOSSBilling; if no patch is released within 30 days, develop migration plan to alternative billing solutions or implement full network isolation restricting FOSSBilling to internal-only access.

FOSSBilling CVE-2026-43921

Q: What is the CVSS score of CVE-2026-43921?

CVE-2026-43921 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41961 HIGH

Code Injection (CWE-94)

2026-07-06 GitHub_M

PHP RCE Code Injection Fossbilling

8.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable admin action with no user interaction (AV:N/AC:L/UI:N) but requires administrator privileges (PR:H); yields full RCE within the app process, so C/I/A:H and scope unchanged (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:26 vuln.today

DescriptionCVE.org

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's Config::prettyPrintArrayToPHP() method. When configuration values are updated, string values are written into config.php without escaping single quotes. Because config.php is loaded via a bare include on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit config.php for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.

Articles & Coverage 1

News 5 New PHP Vulnerabilities - 2 Critical, 3 High, 2 With POC Jul 07, 2026

AnalysisAI

Authenticated remote code execution in FOSSBilling 0.6.10 through 0.7.2 lets an admin-privileged user inject arbitrary PHP into config.php via the Config::prettyPrintArrayToPHP() method, which fails to escape single quotes in string configuration values. Because config.php is pulled in through a bare include on every HTTP request, injected code runs persistently on all subsequent requests. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 8.9, elevated by the persistent, server-wide impact once an admin account is abused.

Technical ContextAI

The affected component is FOSSBilling, a PHP-based open-source billing and client-management platform (cpe:2.3:a:fossbilling:fossbilling). The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): when configuration is saved, prettyPrintArrayToPHP() serializes PHP array values back into a source file (config.php) by wrapping strings in single quotes but never escaping embedded single quotes or PHP syntax. Since config.php is executed by the interpreter via a plain include on each request rather than being parsed as inert data (e.g., JSON), any value that breaks out of the single-quoted string literal is treated as live PHP code, turning a data-write into arbitrary code execution.

RemediationAI

Vendor-released patch: upgrade to FOSSBilling 0.8.0, which corrects the escaping in Config::prettyPrintArrayToPHP(); this is the primary and complete fix. Where immediate upgrade is not possible, the vendor-suggested compensating controls are: restrict administrative access strictly to trusted personnel (reduces the pool of accounts that can trigger the injection, but does not stop an already-compromised admin session); audit config.php for unexpected or non-standard PHP code as a detection measure (finds prior exploitation but does not prevent it); and at the reverse proxy or WAF layer, block or tightly restrict access to the admin API endpoints that modify configuration (effective if those endpoints are not needed from untrusted networks, but may break legitimate configuration changes if scoped too broadly). Refer to advisory GHSA-v4j9-w6pj-38w5 for authoritative guidance.