CVE-2026-53641

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.6.0 through 0.7.2

Description A stored cross-site scripting (XSS) issue exists in the client-facing email history views. This occurs because email HTML content, specifically the content html variable, is rendered into a JavaScript template literal using the |raw filter, which bypasses output escaping. An attacker with administrative privileges can inject malicious JavaScript payloads into email content that will execute in the browser of any client viewing their email history.

Recommendations Update to version 0.8.0. Restrict admin account access. Audit email content in the database for suspicious payloads. Monitor client accounts for unusual activity.