CVE-2026-64619

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vastsa/FileCodeBox/commit/1b6d8e7277d3cfa34dc7a85803731d927b2147da
https://github.com/vastsa/FileCodeBox/issues/479
https://github.com/vastsa/FileCodeBox/releases/tag/V2.4
https://www.vulncheck.com/advisories/filecodebox-anti-bruteforce-rate-limit-bypass-via-spoofed-headers

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) FileCodeBox antes de 2.4 contiene una vulnerabilidad de omisión de límite de tasa en la clase IPRateLimit que permite a atacantes no autenticados eludir la limitación de solicitudes al suministrar encabezados X-Real-IP y X-Forwarded-For controlados por el atacante sin verificación del origen de un proxy inverso de confianza. Los atacantes pueden suministrar valores de IP falsificados únicos en cada solicitud para enumerar todos los códigos de compartición posibles y recuperar archivos de otros usuarios sin autenticación.

Information

Published : 2026-07-20 19:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-64619

Mitre link : CVE-2026-64619

CVE.ORG link : CVE-2026-64619

JSON object : View

Products Affected

No product.

CWE

CWE-348

Use of Less Trusted Source

{"id": "CVE-2026-64619", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64619", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T20:16:03.562332Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/vastsa/FileCodeBox", "vendor": "vastsa", "product": "FileCodeBox", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4", "versionType": "custom"}], "packageURL": "pkg:github/vastsa/FileCodeBox", "defaultStatus": "unaffected"}]}], "published": "2026-07-20T19:17:30.373", "references": [{"url": "https://github.com/vastsa/FileCodeBox/commit/1b6d8e7277d3cfa34dc7a85803731d927b2147da", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/vastsa/FileCodeBox/issues/479", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/vastsa/FileCodeBox/releases/tag/V2.4", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/filecodebox-anti-bruteforce-rate-limit-bypass-via-spoofed-headers", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-348"}]}], "descriptions": [{"lang": "en", "value": "FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication."}, {"lang": "es", "value": "FileCodeBox antes de 2.4 contiene una vulnerabilidad de omisi\u00f3n de l\u00edmite de tasa en la clase IPRateLimit que permite a atacantes no autenticados eludir la limitaci\u00f3n de solicitudes al suministrar encabezados X-Real-IP y X-Forwarded-For controlados por el atacante sin verificaci\u00f3n del origen de un proxy inverso de confianza. Los atacantes pueden suministrar valores de IP falsificados \u00fanicos en cada solicitud para enumerar todos los c\u00f3digos de compartici\u00f3n posibles y recuperar archivos de otros usuarios sin autenticaci\u00f3n."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "disclosure@vulncheck.com"}