CVE-2026-43921 FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
An attacker with admin privileges can inject arbitrary PHP code into configuration files, leading to remote code execution on every subsequent request.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43921?
CVE-2026-43921 is a high-severity code injection vulnerability in FOSSBilling, published on 6 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into `config.php` without escaping single quotes. Because `config.php` is loaded via a bare `include` on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code that executes on every subsequent request. Version 0.8.0 contains a patch. Some workarounds are available. Restrict admin access to trusted personnel only; audit `config.php` for unexpected PHP code; and/ or at the reverse proxy/WAF level, restrict access to admin API endpoints that modify configuration.
Weakness: CWE-94
Which versions are affected by CVE-2026-43921?
How do I fix CVE-2026-43921?
No fix has been published for CVE-2026-43921 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-43921 being exploited?
There is no known exploitation of CVE-2026-43921 in the wild and no public exploit code.
Sources
Also known as GHSA-v4j9-w6pj-38w5.