Rate-Limit Bypass in FileCodeBox via Spoofed Headers

Executive Summary

CVE-2026-64619 is a rate-limit bypass vulnerability in FileCodeBox versions before 2.4. It exists in the IPRateLimit class where the system fails to verify trusted reverse proxy origins for headers like X-Real-IP and X-Forwarded-For. Attackers can spoof these headers with unique IP values per request to bypass request throttling and enumerate share codes to access other users' files without authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual patterns in HTTP headers like X-Real-IP and X-Forwarded-For. Check if multiple requests with unique spoofed IPs are bypassing rate limits. Inspect logs for repeated share code enumeration attempts or unauthorized file access.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can bypass anti-bruteforce protections and enumerate all possible share codes to retrieve other users' files. They can also bypass upload throttling to abuse storage resources. The small 5-digit share code space (90,000 values) makes enumeration feasible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, violating data protection principles under GDPR and HIPAA. Unauthenticated attackers can enumerate share codes to retrieve other users' files, potentially exposing personal or confidential data without consent or proper access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade FileCodeBox to version 2.4 or later to patch the vulnerability. Ensure your reverse proxy configuration validates trusted headers and does not rely solely on application-layer headers for IP determination.

Useful 0 Not Useful 0