Attack Chain

1. An unauthenticated attacker identifies a FileCodeBox instance running a vulnerable version (prior to 2.4).
2. The attacker crafts HTTP requests targeting FileCodeBox endpoints that handle shared content or are subject to rate limiting for access attempts.
3. The attacker injects X-Real-IP and X-Forwarded-For HTTP headers into these requests, assigning unique, attacker-controlled IP addresses for each individual request.
4. The vulnerable IPRateLimit class in FileCodeBox processes these requests without adequately verifying the trustworthiness of the X-Real-IP and X-Forwarded-For headers.
5. This critical flaw bypasses the application's rate limiting mechanism, enabling the attacker to send a high volume of requests in rapid succession.
6. The attacker leverages these rapid requests to systematically enumerate or brute-force all possible share codes for files hosted on the platform.
7. Upon successfully identifying valid share codes, the attacker makes subsequent requests using these codes to retrieve the corresponding files.
8. The attacker successfully gains unauthorized access to and exfiltrates sensitive or private files belonging to other FileCodeBox users without requiring any form of authentication.

Impact

Successful exploitation of CVE-2026-64619 allows unauthenticated attackers to bypass security controls designed to prevent brute-force attacks and unauthorized access. The primary impact is the unauthorized retrieval of other users' files, potentially leading to widespread data exfiltration. While no specific victim counts or targeted sectors are provided in the advisory, any organization or individual using FileCodeBox versions prior to 2.4 could be at risk of having their shared files accessed by malicious actors without their consent. This can result in significant privacy breaches, exposure of sensitive information, and reputational damage.

Recommendation

• Immediately update FileCodeBox instances to version 2.4 or later to patch CVE-2026-64619. Refer to the GitHub release at https://github.com/vastsa/FileCodeBox/releases/tag/V2.4.
• Review the commit https://github.com/vastsa/FileCodeBox/commit/1b6d8e7277d3cfa34dc7a85803731d927b2147da for details on the fix and implement similar robust verification of X-Real-IP and X-Forwarded-For headers if running a custom or forked version.
• Monitor web server access logs for a high volume of requests with rapidly changing X-Real-IP or X-Forwarded-For headers, particularly those targeting file sharing or download endpoints.