Path Traversal Vulnerability in FOSSBilling Open Source Billing Platform

CVE-2026-111053

What is CVE-2026-111053?

FOSSBilling, an open-source billing and client management platform, contains a security vulnerability that allows attackers to exploit the unauthenticated api/guest/system/template_exists endpoint. An attacker can manipulate the file parameter to perform path traversal, enabling them to craft requests that traverse the directory structure. This vulnerability does not permit content disclosure but allows attackers to confirm the existence of arbitrary files on the server. The issue arises from insufficient validation of input parameters, failing to reject traversal sequences. The vulnerability has been addressed in version 0.8.7 of FOSSBilling.

References