FOSSBilling EUVD-2026-104416

No special configuration is required: exploitation needs only network reachability to the unauthenticated api/guest/system/template_exists endpoint on any FOSSBilling instance in the 0.1.0-0.8.6 range, and the attacker must supply '..' traversal sequences in the file parameter because templateExists calls Path::join on attacker-controlled input without rejecting '..' or confirming the resolved path stays inside the active theme directory. The principal LIMITING factor is impact scope, not access: the endpoint returns only a boolean indicating file/directory existence and never discloses contents, so the practical outcome is a filesystem-existence oracle for reconnaissance rather than data theft or execution. No authentication (PR:N) and no user interaction (UI:N) are needed.

This is a moderate, bounded-impact vulnerability whose signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects a remote, unauthenticated, low-complexity attack against the api/guest/system/template_exists endpoint, and the single Low confidentiality impact (VC:L, with VI:N/VA:N) accurately captures that this is an existence oracle, not a file-read or code-execution bug - the description explicitly states 'The oracle does not disclose file contents.' No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' The 6.9 (Medium) score is appropriate and not inflated: real-world risk is primarily reconnaissance value (confirming presence of sensitive files/paths, mapping server layout) that could feed a follow-on attack, rather than direct compromise. Overall this is a legitimate but low-urgency fix - prioritize patching to 0.8.7, but it is not a drop-everything issue absent evidence of chaining to a higher-impact flaw.

An unauthenticated attacker sends a request to guest/system/template_exists with '../' traversal sequences in the file parameter (e.g. pointing at ../../../../etc/passwd or a config/backup path). By reading the returned boolean, the attacker confirms whether specific files or directories exist outside the active theme directory, enabling server fingerprinting and target reconnaissance. No public exploit code is identified in the provided data, but the attack is trivial to script given AV:N and AC:L.