Executive brief
FileCodeBox is a file-sharing application used to exchange documents and text via short share codes. A security flaw allows attackers to bypass the system's rate limits, enabling them to rapidly guess share codes and download private files or text shared by other users without any authorization. This could lead to the mass exposure of sensitive data stored on the platform.
Technical details
A rate-limit bypass exists in the IPRateLimit class of FileCodeBox due to the improper trust of HTTP headers. The application relies on attacker-controlled 'X-Real-IP' and 'X-Forwarded-For' headers to identify clients for throttling without verifying if the request originated from a trusted reverse proxy. By rotating these header values, an unauthenticated remote attacker can bypass anti-brute-force protections. This allows for the automated enumeration of the 5-digit numeric share code space (90,000 possible values), which is generated using a non-cryptographic PRNG. Successful exploitation enables the unauthorized retrieval of shared files and text, as well as the bypass of upload rate limits. The issue is fixed in version 2.4.
Affected products
- vastsa FileCodeBox < 2.4
Timeline
- 2026-06-08: disclosed: Vulnerability reported to vendor via GitHub issue
- 2026-06-15: patched: Version 2.4 released with fix
- 2026-07-20: advisory: CVE-2026-64619 published