FOSSBilling CVE-2026-43921

Requires an authenticated FOSSBilling administrator account (CVSS PR:H) with access to the configuration-update functionality that invokes Config::prettyPrintArrayToPHP(); the injected string must be routed through a config value that gets written to config.php, and config.php must be loaded via its normal bare include (default behavior). Limiting factors: exploitation is impossible for anonymous or low-privileged users, so an attacker must first obtain admin rights, and only versions 0.6.10-0.7.2 are vulnerable (0.8.0+ is fixed). No end-user interaction is needed (UI:N), and it works remotely over the network (AV:N), but the admin-privilege barrier is the core constraint on realistic exploitation.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, VC/VI/VA:H, SC/SI/SA:H) drives the 8.9 score, but the decisive limiter is PR:H - exploitation requires an authenticated administrator, so this is a privilege-escalation / persistence primitive rather than an unauthenticated internet-facing RCE. AT:P further signals a required precondition (the config-update workflow). No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or automatable mass exploitation; the realistic threat model is a malicious or compromised admin, or an admin session hijacked via another bug (CSRF/XSS/credential theft) that then chains into durable server compromise. Net: a genuine high-severity issue for multi-admin or shared-hosting deployments, but not a drop-everything internet-worm scenario given the admin prerequisite. Note the input carries only a CVSS 4.0 vector - no 3.1 vector was supplied - so cross-framework comparison relies on this analyst's independent assessment.

An attacker who has obtained FOSSBilling administrator access - via stolen credentials, an insider, or a hijacked admin session - updates a configuration string value containing a single quote followed by PHP code (e.g., a webshell). prettyPrintArrayToPHP() writes it verbatim into config.php, and because that file is include-d on every request, the payload executes server-side on the very next page load, giving persistent code execution. No public POC was provided, but the technique is straightforward for anyone with admin access.