Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-64619FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers

High 7.5

In plain English

A high-severity security flaw in FileCodeBox from vastsa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.

Affected products (as reported)

Vendor	Product	Versions
vastsa	FileCodeBox	0 – before 2.4

Weakness: CWE-348 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description, issue-tracking
FileCodeBox 2.4 Release Notes patch, release-notes
Patch Commit patch
https://www.vulncheck.com/advisories/filecodebox-anti-bruteforce-rate-limit-bypass-via-spoofed-headers third-party-advisory