CVE-2026-64619: FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64619?
The severity of CVE-2026-64619 is rated high with a score of 7.5.
How do I fix CVE-2026-64619?
To fix CVE-2026-64619, update FileCodeBox to version 2.4 or later.
What type of vulnerability is CVE-2026-64619?
CVE-2026-64619 is a rate-limit bypass vulnerability in the IPRateLimit class of FileCodeBox.
Who is affected by CVE-2026-64619?
CVE-2026-64619 affects users of FileCodeBox versions prior to 2.4.
What can attackers do with CVE-2026-64619?
Attackers can circumvent request throttling by manipulating X-Real-IP and X-Forwarded-For headers.