Executive brief
FOSSBilling, an open-source billing and client management platform, contains a flaw in how it handles downloadable product files. Because the system uses predictable naming for uploaded files, an administrator could accidentally or intentionally overwrite an existing product file by uploading a new one with the same name. This could result in customers receiving the wrong digital products or unauthorized access to files intended for different orders.
Technical details
FOSSBilling (versions 0.1.0 through 0.8.0) uses a deterministic MD5 hash of the original filename to determine the storage path for downloadable product files. Because this hash does not incorporate unique identifiers like product IDs or timestamps, filename collisions occur globally across the uploads directory. An attacker with 'servicedownloadable.manage' privileges can intentionally overwrite existing files by uploading a file with the same name as a target resource. This allows for the substitution of digital goods, potentially leading to unauthorized data disclosure or delivery of incorrect assets to customers. The issue is resolved in version 0.8.1 by moving away from deterministic filename-based storage.
Affected products
- FOSSBilling FOSSBilling 0.1.0 to 0.8.0
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD
- 2026-08-01: patched: Fixed in version 0.8.1