Answer in brief
CVE-2026-111048 records a High severity (CVSS 8.4) vulnerability in FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes. The current sources do not mark it as known exploited. The current feed maps FOSSBilling/FOSSBilling (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps FOSSBilling/FOSSBilling (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| FOSSBilling/FOSSBillinggeneric | >=0.1.0 <0.8.9 | 0.8.9 |
Published upstream
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 2, 2026
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.
Quoted source text, attributed separately from HOL analysis.