Race Condition Vulnerability in FileCodeBox

A race condition vulnerability exists in the Pickup Limit Handler component of vastsa FileCodeBox, specifically within the update_file_usage function found in apps/base/views.py. This flaw, tracked as CVE-2026-82543, affects all versions up to and including 2.3. The vulnerability can be exploited remotely by an unauthenticated attacker to manipulate file usage constraints, potentially bypassing intended limits on file access or storage. Public exploit code is currently available, increasing the risk of exploitation by threat actors. Defenders should prioritize patching, as this vulnerability represents a significant security oversight in the handling of concurrent file operations. The maintainers have released version 2.5.0 to address this issue, which includes the necessary logic fixes in the affected code path.

Impact

Successful exploitation of CVE-2026-82543 allows remote attackers to bypass resource limits managed by the Pickup Limit Handler. This may lead to unauthorized data retrieval or denial of service through resource exhaustion. While the scope of target environments is primarily installations of FileCodeBox, the availability of public exploit code increases the likelihood of opportunistic attacks against exposed instances.

Recommendation

• Upgrade FileCodeBox to version 2.5.0 immediately to remediate CVE-2026-82543.
• Apply the patch identified by commit hash 8d7d856c62d73badd0797eb4daec8d2ff10a403a if upgrading the full application is not immediately feasible.
• Review web server access logs for anomalous request patterns targeting /apps/base/views.py or endpoints associated with the Pickup Limit Handler that exhibit high-frequency requests characteristic of race condition exploitation.