PT-2026-61697 · Vastsa · Filecodebox

George Chen · CVE-2026-64619 · Published 2026-07-20 · Updated 2026-07-20

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.

Fix

Weakness Enumeration

CWE-348

Related Identifiers

CVE-2026-64619

Affected Products

Filecodebox

References · 5

• https://github.com/vastsa/FileCodeBox/commit/1b6d8e7277d3cfa34dc7a85803731d927b2147da · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-64619 · Security Note
• https://github.com/vastsa/FileCodeBox/issues/479 · Note
• https://github.com/vastsa/FileCodeBox/releases/tag/V2.4 · Note
• https://vulncheck.com/advisories/filecodebox-anti-bruteforce-rate-limit-bypass-via-spoofed-headers · Note