FOSSBilling is a free, open‑source billing and client‑management system. Up to version 0.8.0, downloadable product files are stored using a deterministic filename‑derived path: the system writes the file to the uploads directory as `md5(<original filename>)`. Because the storage path depends only on the client‑supplied filename, two different downloadable products or product/order files that share the same original name will map to the same physical file. A subsequent administrator upload with that identical filename can overwrite a previously stored file, causing customers or administrators to receive a different, potentially malicious, file. Version 0.8.1 fixes the flaw. Workarounds include restricting the `servicedownloadable.manage` permission to fully trusted administrators and ensuring that downloadable product files use unique filenames before upload, which reduces accidental collisions but does not solve the underlying issue.

All FOSSBilling installations prior to version 0.8.1 are affected. Any instance that permits an administrator to upload product files can be exposed to filename‑collision attacks.

The vulnerability’s CVSS score of 5.1 indicates moderate severity, and its EPSS score of < 1% shows exploitation is rare. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers need servicedownloadable.manage authority to upload a file; once that permission is held, replacing a legitimate file with a malicious one linked to the same original filename is trivial, leading to unintended content delivery.