Executive brief
FileCodeBox is an open-source file-sharing application that allows users to securely share files and text using passcodes. A race condition vulnerability in the file usage tracking function allows an attacker to manipulate usage limits by exploiting timing windows during concurrent access, potentially enabling unauthorized file storage or circumventing storage quotas.
Technical details
The vulnerability is a race condition in the `update_file_usage` function within the Pickup Limit Handler component (apps/base/views.py) in FileCodeBox versions up to 2.3. The flaw allows concurrent requests to manipulate file usage tracking due to insufficient synchronization when updating usage metrics. An unauthenticated remote attacker can exploit this by sending multiple concurrent requests to bypass or manipulate usage limits. The vulnerability is resolved in version 2.5.0 via commit 8d7d856c62d73badd0797eb4daec8d2ff10a403a, which hardens the share retrieval and admin visibility logic.
Affected products
- vastsa FileCodeBox up to 2.3
Timeline
- 2026-08-30: disclosed
- 2026-07-10: patched: Fix released in version 2.5.0