CVE-2026-111053: FOSSBilling Path Traversal Vulnerability

CVE-2026-111053 Overview

CVE-2026-111053 is a path traversal vulnerability [CWE-22] in FOSSBilling, an open source billing and client-management platform. The flaw resides in the unauthenticated api/guest/system/template_exists endpoint. The templateExists function uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or verifying that the resolved path remains inside the active theme directory. Affected versions span 0.1.0 through 0.8.6. The issue is fixed in version 0.8.7.

Critical Impact

Unauthenticated attackers can probe the server file system to confirm the presence of arbitrary files or directories outside the theme directory, enabling reconnaissance for subsequent attacks.

Affected Products

• FOSSBilling versions 0.1.0 through 0.8.6
• Deployments exposing the guest/system/template_exists API endpoint
• Self-hosted FOSSBilling instances reachable over the network

Discovery Timeline

• 2026-10-19 - CVE-2026-111053 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111053

Vulnerability Analysis

The vulnerability exists in the templateExists method exposed through the unauthenticated api/guest/system/template_exists endpoint. The handler accepts a file parameter and passes it directly to Path::join to construct a path relative to the active theme directory. The code does not canonicalize the resulting path, reject .. sequences, or validate that the resolved path remains within the theme directory boundary.

Attackers submit traversal sequences in the file parameter and observe the returned boolean response. This creates a file existence oracle covering any location readable by the web server process. The oracle does not disclose file contents, but it exposes directory structure, installed software, user accounts, and configuration file paths.

The endpoint requires no authentication, lowering the barrier for exploitation and enabling automated scanning at scale. Successful reconnaissance typically precedes more targeted attacks against discovered artifacts.

Root Cause

The root cause is missing input validation on the file parameter prior to path construction. Path::join concatenates path segments without resolving or sandboxing the result. Without explicit canonicalization and prefix validation against the theme directory, traversal sequences escape the intended directory scope.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues HTTP requests to the guest/system/template_exists endpoint with crafted file values containing .. traversal sequences. The returned boolean reveals whether the resolved path exists on disk.

GET /api/guest/system/template_exists?file=../../../../etc/passwd

Response: { "result": true }

Detection Methods for CVE-2026-111053

Indicators of Compromise

• HTTP requests to /api/guest/system/template_exists containing .., %2e%2e, or encoded traversal variants in the file parameter
• High-volume unauthenticated requests to the guest/system/template_exists endpoint from a single source
• Sequential probing patterns targeting common sensitive paths such as /etc/passwd, /etc/shadow, or application configuration files

Detection Strategies

• Deploy web application firewall rules that inspect query parameters for traversal sequences targeting the vulnerable endpoint
• Correlate access logs for repeated 200 responses on template_exists with varying file parameters indicative of brute-force path enumeration
• Alert on unauthenticated API calls to guest/system/template_exists where the file parameter does not match expected template name patterns

Monitoring Recommendations

• Enable verbose logging on the FOSSBilling API gateway capturing full query strings and response codes
• Forward web server access logs to a centralized SIEM for pattern analysis across time windows
• Monitor outbound reconnaissance follow-ups such as targeted exploitation of files confirmed via the oracle

How to Mitigate CVE-2026-111053

Immediate Actions Required

• Upgrade FOSSBilling to version 0.8.7 or later, which contains the fix for CVE-2026-111053
• Restrict network exposure of the FOSSBilling administrative interface and guest API endpoints to trusted sources where feasible
• Review web server access logs for prior exploitation attempts against guest/system/template_exists

Patch Information

The fix is included in FOSSBilling 0.8.7, applied via Pull Request #4221 and commit e6ca773. Full technical details are available in the GHSA-fm3x-cx5r-wwgp advisory.

The backport also updates composer.json to require php-64bit:

     },
     "require": {
         "php": ">=8.3",
+        "php-64bit": "*",
         "ext-curl": "*",
         "ext-intl": "*",
         "ext-mbstring": "*",

Source: GitHub Commit e6ca773

Workarounds

• Block requests to /api/guest/system/template_exists at the web application firewall or reverse proxy until the upgrade is applied
• Add a WAF signature rejecting file parameters containing .., %2e%2e, or null byte sequences on the affected endpoint
• Restrict file system permissions for the web server process to minimize the scope of readable artifacts enumerable via the oracle

# Example nginx block rule for the vulnerable endpoint
location = /api/guest/system/template_exists {
    if ($arg_file ~* "\.\.|%2e%2e") {
        return 403;
    }
    return 403;  # Block entirely until patched
}