CVE-2026-64619

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-64619

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64619.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-64619

Published

2026-07-20T18:50:12.359Z

Modified

2026-07-22T05:31:52.341325319Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers

Details

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64619.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-348"
    ]
}

References

Affected packages

Git / github.com/vastsa/filecodebox

Affected ranges

Type

GIT

Repo

https://github.com/vastsa/filecodebox

Events

Introduced

Fixed

cdaf3638b80a12f0b22e620815653c7e065916f1

Fixed

1b6d8e7277d3cfa34dc7a85803731d927b2147da

Database specific

{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4"
        }
    ]
}

Affected versions

2.*

2.2

Other

Main

V1.*

V1.1

V1.2

V1.4

V1.4.1

V1.4.3

V1.4.4

V1.4.5

V1.5.1

V1.5.2

V1.5.3

V1.5.4

V1.5.6

V1.5.7

V1.5.9

V1.5.9.1

V1.5.9.2

V1.6

V1.7Beta

V2.*

V2.0

V2.1

V2.3

v2.*

v2.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64619.json"