CVE-2026-111053
Deferred Deferred - Pending Action

Path Traversal in FOSSBilling via template_exists

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/template_exists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or verifying that the resolved path remains inside the active theme directory. The trigger is an unauthenticated request to guest/system/template_exists containing traversal sequences in the file parameter. An attacker can submit traversal sequences in the file parameter and observe the returned boolean to determine whether arbitrary files or directories exist on the server. The oracle does not disclose file contents. This issue is fixed in version 0.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111053
EUVD
EUVD-2026-104416

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FOSSBilling FOSSBilling >= 0.1.0, < 0.8.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FOSSBilling versions 0.1.0 to 0.8.7 allows unauthenticated attackers to check for the existence of arbitrary files or directories on the server by exploiting path traversal in the api/guest/system/template_exists endpoint. The file parameter is not properly sanitized, enabling directory traversal sequences like ../ to bypass intended restrictions.

Detection Guidance

To detect this vulnerability, check if your FOSSBilling version is between 0.1.0 and 0.8.7. Use commands like curl to test the affected endpoint: curl -X GET 'http://<target>/api/guest/system/template_exists?file=../../../../etc/passwd' to see if it returns a boolean response indicating file existence.

Impact Analysis

An attacker could use this to probe your system for sensitive files or directories, potentially revealing information about your server configuration or installed software. While it does not allow file content disclosure or direct code execution, it could aid in further attacks by mapping out your file system.

Compliance Impact

This vulnerability may impact compliance by exposing server information that could lead to unauthorized access or data breaches. GDPR and HIPAA require protecting personal and health data; a path traversal flaw could undermine these protections by enabling reconnaissance attacks.

Mitigation Strategies

Immediately upgrade FOSSBilling to version 0.8.7 or later to patch the vulnerability. If upgrading is not possible, restrict access to the api/guest/system/template_exists endpoint via network controls or firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111053. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart