CVE-2026-82543
Received Received - Intake

Race Condition in Vastsa FileCodeBox

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description
A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.5.0 is able to resolve this issue. The patch is named 8d7d856c62d73badd0797eb4daec8d2ff10a403a. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82543
EUVD
EUVD-2026-68203

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vastsa filecodebox 2.5.0
vastsa filecodebox to 2.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the update_file_usage function of vastsa FileCodeBox up to version 2.3. It allows attackers to bypass file retrieval/download limits by manipulating concurrent requests, effectively nullifying count restrictions. The issue stems from improper handling of retrieval limits and lack of atomic operations in the database layer.

Detection Guidance

Detecting this vulnerability requires checking for race conditions in the update_file_usage function of FileCodeBox. Monitor for concurrent requests bypassing file retrieval limits or reusing download URLs indefinitely. Inspect logs for repeated downloads without count decrements. Verify if expired files are still accessible. Check for small numeric share codes enabling enumeration of all shared files.

Impact Analysis

An attacker could exploit this to download files an unlimited number of times within a token window (about 16.7 minutes) without decrementing the retrieval count. This bypasses intended access restrictions and could lead to unauthorized data access or excessive resource usage.

Compliance Impact

The vulnerability allows unauthorized access to file shares through race conditions and missing expiration checks, which could lead to unauthorized data exposure. This may violate GDPR's data protection principles and HIPAA's access controls if sensitive data is involved.

Mitigation Strategies

Upgrade FileCodeBox to version 2.5.0 or apply the patch 8d7d856c62d73badd0797eb4daec8d2ff10a403a. Disable or restrict access to file sharing features if immediate upgrade is not possible. Implement rate limiting on metadata endpoints. Ensure atomic operations for file usage tracking. Review and enforce strict expiration checks for shared files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82543. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart