The vulnerability is a path traversal in the guest/system/template_exists API endpoint. An unauthenticated requester can supply a file parameter containing .. sequences that are concatenated with the active theme directory without validation. The response returns a boolean indicating whether the targeted path exists. Although it does not reveal file contents, the ability to determine filesystem existence can aid attackers in mapping the server’s directory structure and locating sensitive files. This constitutes an information disclosure flaw consistent with CWE‑200 and CWE‑22.

The flaw appears in FOSSBilling versions 0.1.0 through 0.8.6, inclusive. It was fixed in release 0.8.7. All installations of FOSSBilling using the guest/system/template_exists endpoint before that patch are vulnerable.

The CVSS v3.1 score of 6.9 reflects a medium severity threat. The EPSS score is not available and the vulnerability does not appear in the CISA KEV catalog. Attackers can trigger the flaw via any unauthenticated HTTP request to the API endpoint, making the attack vector local network or internet-facing, depending on the deployment. The lack of a query string to fetch contents means the immediate impact is limited to information gathering, but the enumeration data may assist in subsequent credential or privilege escalation attacks. Given the lack of current exploit data and moderate CVSS rating, organizations should treat this as a medium risk and prioritize remediation accordingly.