FOSSBilling 0.8.0 Security Advisory: Session/Upload Hardening and Patch Details

Vulnerability Overview FOSSBilling version 0.8.0 includes fixes for multiple security vulnerabilities, including severe and high-severity issues. This is a major release that may contain breaking changes; therefore, a brief upgrade window is provided prior to the detailed security advisory release. Users should review the release notes, back up their installations, and upgrade to 0.8.0 as soon as possible. Impact Scope Potential Breaking Changes: - FOSSBilling now requires PHP 8.3 or higher. - Guest API routes have been refactored to expose less information. - The public visitor system version endpoint has been removed. - Spamchecker has been migrated to the new Antispam module. - Paidsupport and Servicemembership modules have been removed. - Pagination methods now receive API data directly; custom integrations may require updates. - has been renamed to . - The frontend asset build system has migrated from Webpack Encore to esbuild, and frontend assets have been restructured into a new directory. Security Enhancements: - New mail permission keys and extended permission overrides have been added. - Missing password strength checks have been added. - and have been re-enabled for external services. - The setting is now respected in JSON response headers. - Audit logging has been improved, and the ability to delete them from the admin panel has been removed. - System-level security improvements have been added. - Session handling, cookie handling, request URL handling, invoice processing, and file upload validation have been hardened. - Validation has been improved for payment IPNs, transaction creation, invoice payment processing, and updater database patch handling. - Installer status checks have been hardened to prevent existing files (if invalid) from blocking the public installer, requiring manual repair or deletion. Mitigation Security Enhancements: - New mail permission keys and extended permission overrides have been added. - Missing password strength checks have been added. - and have been re-enabled for external services. - The setting is now respected in JSON response headers. - Audit logging has been improved, and the ability to delete them from the admin panel has been removed. - System-level security improvements have been added. - Session handling, cookie handling, request URL handling, invoice processing, and file upload validation have been hardened. - Validation has been improved for payment IPNs, transaction creation, invoice payment processing, and updater database patch handling. - Installer status checks have been hardened to prevent existing files (if invalid) from blocking the public installer, requiring manual repair or deletion. Other Improvements: - The admin UI and dashboard have been refreshed, including improved dashboard cards, charts, forms, tables, pagination, search, and module screens. - The "Update FOSSBilling" page has been redesigned, including separate update and database patch cards, clearer patch warnings, safer preview build messages, longer timeouts, in-page warnings, and mandatory backup confirmation before updates. - Payment UI, locales, and email templates have been improved. - Currency formatting and administration currency handling have been improved, and module management settings permissions for currencies have been restored. - File backup email templates have been added. - Domain ordering now supports greater control over hosting product options. - Invoice emails and PDFs now include order and product detail variables. - The support module has received broader improvements. - The tax and currency modules have been migrated to Doctrine backend implementations. - FOSSBilling now supports setting a separate "From" identity for emails. - Modules can now be uninstalled from the admin panel. - The installer UI has been refreshed, and configuration validation has been improved. New Features: - A new Antispam module has been added, including support for Cloudflare Turnstile and hCaptcha. - Widgets have been introduced, and new widget positions have been added to the client area. - Client dashboard API endpoints have been added. - Default country settings have been added. - URL field types with validation have been added. - The attribute has been introduced. - The event has been added. Bug Fixes: - Fixed client profile save issues and implemented stronger profile validation. - Fixed the invisible company logo on the employee authentication page. - Fixed CWP integration issues. - Fixed CSS cleanup paths and missing Bootstrap collapse behavior in Huraq. - Fixed Tom Select behavior in the admin panel. - Fixed downloadable products. - Fixed duplicate and missing renewals with improved recurring handling. - Fixed invoice filtering, invoice numbering, PDF Unicode handling, and invoice template layout issues. - Fixed logical issues in SQL WHERE clauses by adding correct grouping. - Fixed custom page slug anomalies. - Fixed semicolon insertion issues in the admin panel. - Fixed

Goal Reached Thanks to every supporter — we hit 100%!

FOSSBilling 0.8.0 Security Advisory: Session/Upload Hardening and Patch Details

More from this source