CVE-2026-82543

HighCVSS 7.3

Published: 30/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 30/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

A vulnerability was detected in vastsa FileCodeBox up to 2.3. The vulnerability affects the function update_file_usage in the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. The attack can be initiated remotely. The exploit is public. Upgrading to version 2.5.0 resolves the issue.

Risk Assessment

Risk of data integrity compromise and potential unauthorized access to files due to race condition.

Recommendation

Update FileCodeBox to version 2.5.0 or later, which includes the patch (8d7d856c62d73badd0797eb4daec8d2ff10a403a).

Other vulnerabilities in FileCodeBox

CVE-2026-64619High
FileCodeBox before version 2.4 has a rate-limit bypass vulnerability in the IPRateLimit class. An unauthenticated attacker can supply controlled X-Real-IP and X-Forwarded-For headers without trusted reverse proxy verification, allowing enumeration of share codes and retrieval of other users' files.

Original NVD description (English source)

A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.5.0 is able to resolve this issue. The patch is named 8d7d856c62d73badd0797eb4daec8d2ff10a403a. Upgrading the affected component is recommended.