Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨 HIGH: CVE-2026-64619 (CVSS 7.5) - FileCodeBox <2.4 rate-limit bypass via header spoofing. Unauthenticated attackers can enumerate share codes & access files. Upgrade to v2.4+ immediately. #CVE #PatchNow #ThreatIntel https://t.co/uG1z8oq039
Post summary
The tweet discloses CVE-2026-64619, details a rate‑limit bypass via header spoofing and urges users to upgrade to v2.4+ to mitigate the vulnerability.