CVE-2026-64619

HighCVSS 7.5

Published: 20/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

FileCodeBox before version 2.4 has a rate-limit bypass vulnerability in the IPRateLimit class. An unauthenticated attacker can supply controlled X-Real-IP and X-Forwarded-For headers without trusted reverse proxy verification, allowing enumeration of share codes and retrieval of other users' files.

Risk Assessment

An attacker can gain unauthorized access to all files shared by other users, leading to data confidentiality breach.

Recommendation

Update FileCodeBox to version 2.4 or later, which includes a fix for this vulnerability.

Other vulnerabilities in FileCodeBox

CVE-2026-82543High
A vulnerability was detected in vastsa FileCodeBox up to 2.3. The vulnerability affects the function update_file_usage in the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. The attack can be initiated remotely. The exploit is public. Upgrading to version 2.5.0 resolves the issue.

Original NVD description (English source)

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.