What is CVE-2026-111048 in FOSSBilling?
FOSSBilling is an open-source billing and client-management platform that handles support tickets and notes. A critical vulnerability tracked as CVE-2026-111048 has been identified with a CVSS score of 8.4, which puts systems running unpatched versions at risk.
Similar to incidents like CVE-2026-58946: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios, este fallo expone graves riesgos de seguridad dentro de los paneles de control.
The issue centers around how inputs are processed and rendered back to administrators without proper encoding or filtering.
Who is affected and how does the vulnerability work?
The flaw stems from the admin/support/note_create endpoint, which stores the note parameter without any sanitization in the support_ticket_note table. Later, the template src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored note using innerHTML inside the admin ticket list.
Because of this implementation, a staff user possessing only the support.manage_tickets permission can inject custom HTML or JavaScript code. When another staff member opens the ticket list, that script executes automatically.
Analogous flaws in architecture are sometimes compared with issues found in other components, such as Vulnerabilidad crítica CVE-2026-115905 con CVSS 10.0 en la librería zip de Rust regarding improper data handling.
What are the security implications of this exploit?
The injected script runs directly with the viewing staff member's session and privileges. This allows the attacker to read CSRF tokens, access client or invoice data, and execute privileged administrative actions, even up to Super Administrator capabilities.
It is worth noting that the individual ticket detail page remains unaffected because its Twig rendering employs proper autoescaping mechanics.
How do I protect my installation?
Administrators must apply the official security patch released by the maintainers to completely close this vector. Reviewing role-based access controls is also recommended to prevent unauthorized internal actors from creating malicious entries.
You can also examine related privilege issues like CVE-2026-58957: Vulnerabilidad Crítica CVSS 8.4 de Escalada de Privilegios to understand similar vector risks.
- Check your current FOSSBilling version to confirm if it is between 0.1.0 and 0.8.9.
- Download and apply the upgrade package for version 0.8.9 or clone the fix from the official repository.
- Audit existing support notes in the database table support_ticket_note for suspicious HTML or script tags.
- Restrict the support.manage_tickets permission exclusively to trusted staff members.