An input validation flaw in HostBill allows a remote attacker to inject malicious CSV data during user registration. By submitting specially crafted CSV entries, an attacker can trigger arbitrary code execution on the server, resulting in loss of confidentiality, integrity, and availability. The vulnerability also enables privilege escalation, allowing the attacker to gain elevated permissions beyond those intended for the registration process.

HostBill, a web-based billing and automation platform, is affected in the October and November 2025 releases (v.2025-11-24 and v.2025-12-01). Users running these versions should verify whether the CSV registration feature is enabled and, if so, consider disabling it until a patch is applied.

The flaw carries a high severity, with automatic code execution and privilege escalation; the lack of a publicly available exploit or EPSS score is mitigated by the obvious nature of the exploitation path through the CSV upload. Attackers need only access to the registration endpoint; no authentication is required to upload the malicious CSV, meaning users or guests can exploit it. EPSS is unavailable, but the existence of a public advisory and targeted release notes indicates that knowledgeable attackers could weaponize this flaw. The vulnerability is not listed in the CISA KEV catalog, but its impact suggests it is a high‑risk issue.