CVE-2026-53648: FOSSBilling Path Traversal Vulnerability

CVE-2026-53648 Overview

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.1 store downloadable product files using a deterministic path derived from the original filename. When an administrator uploads a file, FOSSBilling stores it as md5(<original filename>) under the uploads directory. Two uploads sharing the same original filename resolve to the same stored path. A later upload silently overwrites the earlier file. Customers or administrators downloading the earlier product then receive the attacker-controlled replacement instead. This weakness is classified under CWE-73: External Control of File Name or Path.

Critical Impact
An authenticated administrator with the servicedownloadable.manage permission can overwrite existing downloadable product files, causing customers to receive substituted content on subsequent downloads.

Affected Products

FOSSBilling versions prior to 0.8.1
FOSSBilling downloadable product module
Deployments granting servicedownloadable.manage to non-trusted administrators

Discovery Timeline

2026-07-07 - CVE-2026-53648 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-53648

Vulnerability Analysis

The flaw resides in how FOSSBilling generates storage paths for downloadable product uploads. The application derives the destination path from md5(<original filename>), using only the client-supplied filename as input. The hash function is deterministic, so identical filenames always produce identical storage paths. FOSSBilling does not append entropy such as a product identifier, upload timestamp, or random token to disambiguate uploads.

When a second file is uploaded with the same original filename, the write operation lands on the existing path. The prior file is replaced without warning. Any product record that still references that path now serves the new file content. This affects both distinct downloadable products and per-order file variants. The issue falls under CWE-73, external control of file name or path.

Root Cause

The storage layer trusts a client-supplied value, the original filename, as the sole source of uniqueness. Path derivation lacks a per-record salt, unique identifier, or collision check. FOSSBilling also performs no server-side verification that the target path is unassociated with an existing product before overwriting.

Attack Vector

Exploitation requires an authenticated user holding the servicedownloadable.manage permission. The attacker uploads a malicious or substituted file whose original filename matches a previously uploaded product file. The upload overwrites the legitimate content in-place. Subsequent downloads by customers or administrators return the attacker-supplied file. The vector is network-accessible but gated by high privileges, limiting exposure to environments where the servicedownloadable.manage role is broadly delegated.

No verified proof-of-concept code has been published. See the FOSSBilling GitHub Security Advisory GHSA-x7p2-xhvc-cfp9 for vendor technical details.

Detection Methods for CVE-2026-53648

Indicators of Compromise

Downloadable product files whose modification timestamps differ from the associated product record creation date
Multiple product records in the FOSSBilling database referencing the same md5(filename) path on disk
Customer-reported mismatches between the expected product file and the file received
Audit log entries showing servicedownloadable.manage actions performed by administrators outside of expected change windows

Detection Strategies

Enumerate the uploads directory and cross-reference each stored file hash-path against product records to identify collisions
Compute and store cryptographic hashes of uploaded files at ingest time, then re-verify on scheduled intervals to detect silent replacement
Alert on any write operation to the FOSSBilling uploads directory that overwrites an existing file rather than creating a new one

Monitoring Recommendations

Enable file integrity monitoring on the FOSSBilling uploads directory to record every write and overwrite event
Log all administrator actions invoking servicedownloadable.manage with acting user, product identifier, and source IP
Correlate download events against the last-modified timestamp of the served file to detect post-upload substitution

How to Mitigate CVE-2026-53648

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.1 or later, which patches the deterministic path issue
Audit existing downloadable product files for filename collisions and re-upload any affected products with unique filenames
Restrict the servicedownloadable.manage permission to fully trusted administrators only
Review administrator role assignments and remove the permission from accounts that do not require it

Patch Information

FOSSBilling version 0.8.1 addresses the vulnerability by removing the deterministic filename-derived storage path. Refer to the FOSSBilling GitHub Security Advisory GHSA-x7p2-xhvc-cfp9 for release notes and upgrade guidance.

Workarounds

Restrict the servicedownloadable.manage permission to a minimal set of trusted administrators until the upgrade is applied
Enforce an operational policy requiring unique filenames for every downloadable product before upload, reducing accidental collisions
Rename existing product files to include a unique identifier such as product ID or timestamp prefix, then update product references accordingly

bash

# Example: rename existing uploads to include a unique prefix before re-upload
for f in /var/www/fossbilling/uploads/*; do
  mv "$f" "${f%/*}/$(date +%s)_$(basename "$f")"
done