Is CVE-2026-111053 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111053 being exploited in the wild.

How severe is CVE-2026-111053?

Informational severity, published 19 October 2026.

Is there a fix for CVE-2026-111053?

Yes: fixed in 0.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111053 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111053?

Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111053: FOSSBilling path traversal in template_exists endpoint

CVE-2026-111053 · Severity: info · Published 2026-10-19

FOSSBilling is an open-source billing and customer management platform. An unauthenticated attacker can exploit a path traversal vulnerability in the template_exists API endpoint to determine whether arbitrary files or directories exist on the server by submitting specially crafted requests with directory-traversal sequences. While the vulnerability does not disclose file contents, an attacker could use this information gathering to map the server's filesystem and identify targets for further exploitation.

Technologies: FOSSBilling. Vendors: FOSSBilling.

Quick answers

Is CVE-2026-111053 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111053 being exploited in the wild.
How severe is CVE-2026-111053?: Informational severity, published 19 October 2026.
Which products and versions are affected?: FOSSBilling 0.1.0 to 0.8.6.
Is there a fix for CVE-2026-111053?: Yes: fixed in 0.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111053 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111053?: Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.8.7

Technical details

The api/guest/system/template_exists endpoint accepts an unauthenticated file parameter and uses Path::join() to resolve the path without rejecting ".." sequences or validating that the resolved path stays within the active theme directory. An attacker can submit traversal sequences (e.g., "../../etc/passwd") and infer file existence from the returned boolean, creating an oracle for arbitrary path enumeration. No authentication is required and the vulnerability was fixed in version 0.8.7 by hardening template existence checks.

Affected products

FOSSBilling FOSSBilling 0.1.0 to 0.8.6

Timeline

2026-10-19: disclosed
2026-08-27: patched: Fix merged in 0.8.7 release preparation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.