CVE-2026-111048— FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes

Quick assessment

Affected

FOSSBilling FOSSBilling

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FOSSBilling 是一个开源的计费与客户管理平台。在 0.1.0 至 0.8.9 版本中，端点会将参数未经清理地存储到表中；而模板在管理员工单列表中，通过渲染每条已存储的工单备注。仅拥有权限的工作人员可存储 HTML 或 JavaScript 代码，当其他工作人员打开该工单备注时，这些代码将被执行。该脚本将以查看者的会话和权限运行，能够读取 CSRF 令牌及可访问的客户或发票数据，并执行查看者（包括超级管理员）所具备的任何管理操作。工单详情页不受此问题影响，因为其 Twig 渲染启用了自动转义。该

CVSS 8.4 · High EPSS 0.28% · P20 Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1055.001 · Dynamic-link Library Injection

Affected Version Matrix 1

Vendor	Product	Version Range	Status
FOSSBilling	FOSSBilling	`>= 0.1.0, < 0.8.9`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes

Source: CVE Program / CVE List V5

Vulnerability Description

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
FOSSBilling	FOSSBilling	>= 0.1.0, < 0.8.9	-

II. Public POCs for CVE-2026-111048

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111048

请登录查看更多情报信息。

Other References for CVE-2026-111048 (3)

https://github.com/FOSSBilling/FOSSBilling/pull/4548 x_refsource_MISC
https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-493h-fvcx-6q62 x_refsource_CONFIRM
https://github.com/FOSSBilling/FOSSBilling/commit/87528920b6cb1ba6f113583253eb4d7abdd1d8c6 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-111048

IV. Related Vulnerabilities

Same product: FOSSBilling

Same vendor: FOSSBilling

Same weakness: CWE-79