Threat database

CVE-2026-82543 is a race condition vulnerability in vastsa FileCodeBox affecting versions 2.0 through 2.3. The flaw exists in the update_file_usage function within the Pickup Limit Handler component, specifically in apps/base/views.py. This vulnerability can be exploited remotely without authentication. Public exploit code is available. Upgrading to version 2.5.0 resolves the issue.

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.