CVE-2026-111053 Details
Description
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/template_exists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or verifying that the resolved path remains inside the active theme directory. The trigger is an unauthenticated request to guest/system/template_exists containing traversal sequences in the file parameter. An attacker can submit traversal sequences in the file parameter and observe the returned boolean to determine whether arbitrary files or directories exist on the server. The oracle does not disclose file contents. This issue is fixed in version 0.8.7.
A path traversal vulnerability has been identified in FOSSBilling versions 0.1.0 prior to 0.8.7. The issue resides in the unauthenticated 'api/guest/system/template_exists' endpoint, which allows attackers to probe the existence of arbitrary files and directories on the server. This is achieved by sending traversal sequences in the 'file' parameter, exploiting the lack of proper validation before the path is resolved and checked. As a result, attackers can determine the presence of sensitive files, such as configuration files containing database credentials, or system files like '/etc/passwd'. While the vulnerability does not disclose the contents of the files, it provides a means to gather information that could facilitate further attacks.
Users are advised to update FOSSBilling to version 0.8.7, where this vulnerability has been patched. For those unable to update immediately, consider blocking the 'api/guest/system/template_exists' endpoint at the reverse proxy or Web Application Firewall (WAF) level.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/commit/e6ca7731c6bce406aba11900a4450e89c4ebdb01 | [email protected] | Source CodeVendor |
| https://github.com/FOSSBilling/FOSSBilling/pull/4221 | [email protected] | Issue TrackingVendor |
| https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7 | [email protected] | Release NotesVendor |
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-fm3x-cx5r-wwgp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | >= 0.1.0, <= 0.8.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |