CVE-2026-64619 affects FileCodeBox before version 2.4. The vulnerability exists in the IPRateLimit class, which fails to verify that X-Real-IP and X-Forwarded-For headers originate from trusted reverse proxies. Attackers can supply spoofed IP addresses in these headers to circumvent rate limiting, allowing them to enumerate all possible share codes and retrieve files belonging to other users without authentication. The CVSS 4.0 base score is 8.7 (high severity), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows unauthenticated attackers to bypass request throttling and enumerate share codes, leading to unauthorized access to other users' files. This compromises confidentiality of user data stored or shared via FileCodeBox.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or validate the use of X-Real-IP and X-Forwarded-For headers to trusted reverse proxies only to prevent spoofing. Monitor for unusual request patterns that may indicate enumeration attempts.