File Overwrite via Predictable Filename in FOSSBilling

Executive Summary

CVE-2026-53648 is a vulnerability in FOSSBilling versions 0.1.0 through 0.8.0 where downloadable product files are stored using a deterministic filename-derived path based on the MD5 hash of the original filename.

Because the stored path depends only on the client-supplied filename, files with the same original filename uploaded for different products or orders will overwrite each other.

This means that a later upload can overwrite an earlier upload, causing customers or administrators to receive the wrong file when downloading a product.

The vulnerability requires authenticated administrators or staff members with the servicedownloadable.manage permission to exploit.

Version 0.8.1 of FOSSBilling patches this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing integrity and confidentiality issues with downloadable product files.

Specifically, customers or administrators may receive incorrect files when downloading products due to file overwrites caused by filename collisions.

This can lead to confusion, loss of trust, or exposure of unintended files.

Since the vulnerability requires high privileges (authenticated administrators or staff with specific permissions), it could be exploited internally or by a compromised trusted user.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves downloadable product files being overwritten due to filename collisions caused by storing files as md5 hashes of their original filenames. Detection would involve checking for files in the uploads directory that share the same MD5 hash-derived filename but originate from different products or orders.

You can detect potential exploitation or risk by listing files in the uploads directory and comparing their MD5 hash-derived names to the original filenames used in product uploads. Additionally, reviewing administrator actions related to file uploads and permissions for servicedownloadable.manage can help identify suspicious activity.

Suggested commands to assist detection might include:

• Listing files in the uploads directory: `ls -l /path/to/fossbilling/uploads/`
• Checking MD5 hashes of original filenames to see if collisions exist: `echo -n "filename.ext" | md5sum`
• Comparing uploaded filenames and their hashes to detect duplicates or overwrites.
• Reviewing user permissions for servicedownloadable.manage to ensure only trusted administrators have this permission.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Restrict the servicedownloadable.manage permission to fully trusted administrators only to limit who can upload downloadable product files.
• Ensure that downloadable product files use unique filenames before upload to reduce the risk of filename collisions and overwriting.
• Upgrade FOSSBilling to version 0.8.1 or later, where this vulnerability has been patched.

Useful 0 Not Useful 0