CVE-2026-53641 FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
Stored XSS in FOSSBilling allows admins to inject scripts into email views, executing code in client browsers and potentially compromising accounts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-53641?
CVE-2026-53641 is a medium-severity cross-site scripting vulnerability in FOSSBilling, published on 6 Jul 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript template literal using the `|raw` filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity.
Which versions are affected by CVE-2026-53641?
How do I fix CVE-2026-53641?
No fix has been published for CVE-2026-53641 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-53641 being exploited?
There is no known exploitation of CVE-2026-53641 in the wild and no public exploit code.
Sources
Also known as GHSA-q6c8-6r72-35f7.