CVE-2026-64619 affects FileCodeBox prior to version 2.4 and involves a rate-limit bypass vulnerability in the IPRateLimit class. The vulnerability arises because the application accepts X-Real-IP and X-Forwarded-For headers from untrusted sources without verifying if they originate from a trusted reverse proxy. This allows unauthenticated attackers to spoof IP addresses on each request, circumventing request throttling mechanisms. Consequently, attackers can enumerate all possible share codes and retrieve files belonging to other users without authentication.

An attacker can bypass rate limiting controls and enumerate share codes to access files of other users without authentication. This leads to unauthorized data disclosure and potential privacy breaches. The vulnerability has a high severity score (CVSS 8.7) indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or validate the X-Real-IP and X-Forwarded-For headers to ensure they originate only from trusted reverse proxies. Implement additional request validation or rate limiting based on verified client IPs.