Is CVE-2026-53648 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53648 being exploited in the wild.

How severe is CVE-2026-53648?

Informational severity, with a CVSS score of 5.1, published 7 July 2026.

Is there a fix for CVE-2026-53648?

A patch was published on 2026-08-01: Fixed in version 0.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53648 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-53648?

Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53648: FOSSBilling file overwrite via filename collision in downloadable products

CVE-2026-53648 · Severity: info · CVSS 5.1 · Published 2026-07-07

FOSSBilling, an open-source billing and client management platform, contains a flaw in how it handles downloadable product files. Because the system uses predictable naming for uploaded files, an administrator could accidentally or intentionally overwrite an existing product file by uploading a new one with the same name. This could result in customers receiving the wrong digital products or unauthorized access to files intended for different orders.

Technologies: FOSSBilling. Vendors: FOSSBilling.

Quick answers

Is CVE-2026-53648 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53648 being exploited in the wild.
How severe is CVE-2026-53648?: Informational severity, with a CVSS score of 5.1, published 7 July 2026.
Which products and versions are affected?: FOSSBilling 0.1.0 to 0.8.0.
Is there a fix for CVE-2026-53648?: A patch was published on 2026-08-01: Fixed in version 0.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53648 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-53648?: Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

FOSSBilling (versions 0.1.0 through 0.8.0) uses a deterministic MD5 hash of the original filename to determine the storage path for downloadable product files. Because this hash does not incorporate unique identifiers like product IDs or timestamps, filename collisions occur globally across the uploads directory. An attacker with 'servicedownloadable.manage' privileges can intentionally overwrite existing files by uploading a file with the same name as a target resource. This allows for the substitution of digital goods, potentially leading to unauthorized data disclosure or delivery of incorrect assets to customers. The issue is resolved in version 0.8.1 by moving away from deterministic filename-based storage.

Affected products

FOSSBilling FOSSBilling 0.1.0 to 0.8.0

Timeline

2026-06-12: advisory: GitHub Security Advisory published
2026-07-07: disclosed: CVE published to NVD
2026-08-01: patched: Fixed in version 0.8.1

References

https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-x7p2-xhvc-cfp9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.