# CVE-2026-53648: FOSSBilling file overwrite via filename collision in downloadable products

Source: https://junglewise.ai/threats/cve-2026-53648-fossbilling-file-overwrite-via-filename-collision-in-downloadable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-53648 · Severity: info · CVSS 5.1 · Published 2026-07-07

FOSSBilling, an open-source billing and client management platform, contains a flaw in how it handles downloadable product files. Because the system uses predictable naming for uploaded files, an administrator could accidentally or intentionally overwrite an existing product file by uploading a new one with the same name. This could result in customers receiving the wrong digital products or unauthorized access to files intended for different orders.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-53648 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53648 being exploited in the wild.

**How severe is CVE-2026-53648?** Informational severity, with a CVSS score of 5.1, published 7 July 2026.

**Which products and versions are affected?** FOSSBilling 0.1.0 to 0.8.0.

**Is there a fix for CVE-2026-53648?** A patch was published on 2026-08-01: Fixed in version 0.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53648 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-53648?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

FOSSBilling (versions 0.1.0 through 0.8.0) uses a deterministic MD5 hash of the original filename to determine the storage path for downloadable product files. Because this hash does not incorporate unique identifiers like product IDs or timestamps, filename collisions occur globally across the uploads directory. An attacker with 'servicedownloadable.manage' privileges can intentionally overwrite existing files by uploading a file with the same name as a target resource. This allows for the substitution of digital goods, potentially leading to unauthorized data disclosure or delivery of incorrect assets to customers. The issue is resolved in version 0.8.1 by moving away from deterministic filename-based storage.

## Affected products

- FOSSBilling FOSSBilling 0.1.0 to 0.8.0

## Timeline

- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD
- 2026-08-01: patched: Fixed in version 0.8.1

## References

- [https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-x7p2-xhvc-cfp9](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-x7p2-xhvc-cfp9)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management)