CVE-2026-82543: Race Condition in vastsa FileCodeBox

This vulnerability is a race condition in the update_file_usage function of the Pickup Limit Handler component in vastsa FileCodeBox, versions 2.0 to 2.3. The race condition can be triggered remotely, potentially leading to inconsistent or unintended behavior in file usage tracking. The issue is fixed in version 2.5.0, with the patch identified by commit 8d7d856c62d73badd0797eb4daec8d2ff10a403a. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with network attack vector, no privileges or user interaction required, and partial impact on confidentiality, integrity, and availability.

Exploitation of this race condition could allow an attacker to manipulate file usage data remotely, potentially causing inconsistent application state or denial of service. The impact is rated medium severity with partial loss of confidentiality, integrity, and availability. No known active exploitation in the wild has been reported yet.

Upgrade vastsa FileCodeBox to version 2.5.0 or later, which contains the official patch (commit 8d7d856c62d73badd0797eb4daec8d2ff10a403a) resolving this race condition vulnerability. No other mitigations are indicated by the vendor advisory.