Cross-Site Scripting Vulnerability in FOSSBilling by FOSSBilling Team
CVE-2026-111048
What is CVE-2026-111048?
FOSSBilling, an open-source billing and client management platform, is vulnerable to Cross-Site Scripting (XSS) due to improper sanitization of input from the admin/support/note_create endpoint. Specifically, from versions 0.1.0 to 0.8.9, unsanitized note parameters are stored in the support_ticket_note table. When rendered via innerHTML in the admin ticket list, this allows a staff user with only support.manage_tickets permission to inject malicious HTML or JavaScript. When another staff member views the ticket notes, the injected script executes within their session context, granting access to sensitive data like CSRF tokens, client information, and invoice data, potentially leading to unauthorized administrative actions. The issue is addressed in FOSSBilling version 0.8.9.
Affected Version(s)
FOSSBilling >= 0.1.0, < 0.8.9