EUVD-2026-68203
GHSA-w3qf-xqhv-qhm8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Race condition requires precisely timed concurrent requests (AC:H); pickup code is normal access, so PR:N; no availability impact from quota bypass.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.5.0 is able to resolve this issue. The patch is named 8d7d856c62d73badd0797eb4daec8d2ff10a403a. Upgrading the affected component is recommended.
AnalysisAI
Race condition exploitation in FileCodeBox's Pickup Limit Handler allows remote unauthenticated attackers to bypass configured file download quotas by sending concurrent retrieval requests. The flaw exists in the update_file_usage function (apps/base/views.py) across all releases prior to v2.5.0 - including v2.4.0 despite the CVE description citing only 'up to 2.3'. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required beyond possession of the file's pickup code, which is the normal access credential distributed by the file uploader. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, score 6.9) reflects a remotely accessible, unauthenticated flaw with low-level impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade FileCodeBox to version 2.5.0, which is confirmed patched via GitHub release tag v2.5.0 and commit 8d7d856c62d73badd0797eb4daec8d2ff10a403a (PR #487). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Filecodebox
View allFileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file. Rated medium severity (CVSS 5.3), this v
A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based
A stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and ea
A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is co
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today