FOSSBilling is a free, open-source billing and client‑management system. Prior to version 0.8.1, downloadable product files are stored using a deterministic filename‑derived path. When an administrator uploads a file for a downloadable product, the system records it as md5(<original filename>) in the uploads directory. Because the stored path depends only on the client‑supplied filename, two different downloadable products or product/order files that share the same original name will resolve to the same location. A later upload with the same original filename can overwrite an earlier file, causing customers or administrators to receive newer file instead of the intended one. Version 0.8.1 patches this flaw. Operational mitigations include restricting the servicedownloadable.manage permission to fully trusted administrators and ensuring the product files use unique filenames before upload, which reduces accidental collisions but does not fully address the underlying issue.

All FOSSBilling installations prior to version 0.8.1 are affected. Any instance that permits an administrator to upload product files can be exposed to filename‑collision attacks.

The vulnerability’s CVSS score of 5.1 indicates moderate severity, and its EPSS score of < 1% shows exploitation is rare. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers need servicedownloadable.manage authority to upload a file; once that permission is held, replacing a legitimate file with a malicious one linked to the same original filename is trivial, leading to unintended content delivery.