HostBill Security Advisory
A security update for HostBill has been released for HostBill versions: 2014-12-31 to 2026-11-02. Please update your HostBill to the most recent version.
We were privately notified about an Information Disclosure issue affecting HostBill versions released between 2014-12-31 and 2026-11-02. We have no evidence that this issue has been exploited or that it was publicly known before this disclosure.
While the issue is rated medium severity, the practical risk is low. Exploiting it would require specific actions by a privileged staff member in the admin area. Even so, we recommend updating to the latest version.
Advisory details
- Affected versions: 2014-12-31 to 2026-11-02
- Severity: Medium
- Vulnerability class: Information Disclosure
- Known public exploitation: none known
- Fixed in: 2026-11-03 or higher
Resolution
To fix this issue, update your HostBill to the most recent release, version 2026-11-03 or higher. You can update either manually or with the Auto-Update plugin.
If you have questions about this advisory or need help with the update, please contact our support team.
Acknowledgements
We would like to thank HostingTime GmbH (hostingtime.de) for identifying this issue and disclosing it to us responsibly. Coordinated disclosure like this helps keep the HostBill community safe, and we greatly appreciate it.