CVE-2026-111053: FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or verifying that the resolved path remains inside the active theme directory. The trigger is an unauthenticated request to guest/system/templateexists containing traversal sequences in the file parameter. An attacker can submit traversal sequences in the file parameter and observe the returned boolean to determine whether arbitrary files or directories exist on the server. The oracle does not disclose file contents. This issue is fixed in version 0.8.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.7
Event History
Frequently Asked Questions
Which deployments are exposed?
FOSSBilling versions from 0.1.0 through versions before 0.8.7 are affected if the unauthenticated guest/system/template_exists API endpoint is reachable. No account or authentication is required.
What can an attacker learn through this issue?
An attacker can use traversal sequences in the file parameter and observe the boolean response to determine whether arbitrary files or directories exist on the server. The endpoint does not disclose file contents.
What is the recommended remediation?
Upgrade FOSSBilling to version 0.8.7, which fixes the path traversal in template_exists.