Vulnerability Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the `Massmailer` module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the `Massmailer` module if it is not required, audit existing records in the `mod_massmailer` table for suspicious filter values, and/or review administrator activity related to `Massmailer` message updates.
Related Weaknesses (CWE)
References
- https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-28
- https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-28
FAQ
What is CVE-2026-33734?
CVE-2026-33734 is a documented vulnerability. FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the `Massmailer` module filter functionality. An authenticat...
How severe is CVE-2026-33734?
CVSS scoring is not yet available for CVE-2026-33734. Check NVD for updates.
Is there a patch for CVE-2026-33734?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.