CVE-2026-111048 Details

A stored cross-site scripting vulnerability has been identified in FOSSBilling, an open-source billing and client management platform, affecting versions 0.1.0 prior to 0.8.9. The issue arises in the admin/support/note_create endpoint, which saves note content directly into the support_ticket_note table without proper sanitization. When these notes are accessed through the admin ticket list, the content is rendered using innerHTML, allowing any embedded HTML or JavaScript to execute in the browser of the staff member viewing the notes. This injected script runs with the privileges of the viewer, potentially including a Super Administrator, and can access sensitive information such as CSRF tokens and client or invoice data. The vulnerability persists until the note is deleted, with the possibility of affecting multiple staff members.

Users can update to FOSSBilling version 0.8.9, which sanitizes note content before storage and changes the rendering method to prevent script execution. Instructions for downloading this version are available on the FOSSBilling GitHub releases page.