Vulnerability Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript template literal using the `|raw` filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-53641?
CVE-2026-53641 is a documented vulnerability. FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of...
How severe is CVE-2026-53641?
CVSS scoring is not yet available for CVE-2026-53641. Check NVD for updates.
Is there a patch for CVE-2026-53641?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.