CVE-2026-40495 FOSSBilling version exposed via asset cache buster
Unauthenticated attackers can determine the exact FOSSBilling version via asset cache buster parameters, bypassing version hiding settings to facilitate targeted attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40495?
CVE-2026-40495 is a medium-severity vulnerability in FOSSBilling, published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 leak the exact system version through asset cache buster parameters in HTML output, bypassing the `hide_version_public` security setting. The FOSSBilling version is embedded in the query string of every `<script>` and `<link>` tag generated by the `script_tag` and `stylesheet_tag` Twig filters. This information is visible to all visitors — including unauthenticated guests — on every page, regardless of whether the `hide_version_public` setting is enabled. The `X-FOSSBilling-Version` HTTP header and the `guest.system.version` API endpoint correctly honour the `hide_version_public` setting, but the asset cache buster parameters were overlooked. Knowledge of the exact FOSSBilling version makes it significantly easier for malicious actors to identify known vulnerabilities applicable to a given installation and craft targeted exploits. While not a direct vulnerability on its own, it undermines the intended protection offered by the `hide_version_public` setting and facilitates reconnaissance. Version 0.8.0 contains a patch. There is no practical workaround that removes the version from asset URLs without modifying source code.
Weakness: CWE-200
Which versions are affected by CVE-2026-40495?
How do I fix CVE-2026-40495?
No fix has been published for CVE-2026-40495 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40495 being exploited?
There is no known exploitation of CVE-2026-40495 in the wild and no public exploit code.
Sources
Also known as GHSA-gqcp-g7rm-p5v6.