CVE-2026-53648

Name of the Vulnerable Software and Affected Versions FOSSBilling versions prior to 0.8.1

Description Downloadable product files are stored using a deterministic path derived from the filename. When an administrator uploads a file, the system stores it as md5(<original filename>) within the uploads directory. Since the path depends solely on the client-supplied filename, multiple products or order files uploaded with the same original filename will resolve to the same storage path. Consequently, a subsequent upload can overwrite a previous one, leading customers or administrators to download the incorrect file.

Recommendations Update to version 0.8.1. Restrict the servicedownloadable.manage permission to fully trusted administrators only. Ensure downloadable product files use unique filenames before upload to reduce accidental collisions.