Vastsa

A race condition vulnerability in the update_file_usage function of FileCodeBox versions up to 2.3 allows remote attackers to manipulate file usage limits.

Unauthenticated attackers can bypass rate limits in FileCodeBox versions before 2.4 due to a vulnerability in the IPRateLimit class, allowing them to enumerate share codes and retrieve other users' files without authentication by spoofing X-Real-IP and X-Forwarded-For headers without proper verification.