CVE-2026-64619: FileCodeBox Auth Bypass Vulnerability

CVE-2026-64619 Overview

CVE-2026-64619 is a rate-limit bypass vulnerability in FileCodeBox versions prior to 2.4. The IPRateLimit class trusts client-supplied X-Real-IP and X-Forwarded-For headers without verifying that the request originated from a trusted reverse proxy. Unauthenticated attackers can rotate spoofed IP values on every request to defeat anti-bruteforce throttling. This enables enumeration of the full share-code keyspace and retrieval of other users' shared files. The weakness is classified as [CWE-348] Use of Less Trusted Source.

Critical Impact
Unauthenticated attackers can enumerate all share codes and exfiltrate files uploaded by other users by bypassing IP-based rate limiting.

Affected Products

FileCodeBox versions prior to 2.4
Deployments exposing FileCodeBox directly to the internet without a trusted reverse proxy configuration
Instances running the IPRateLimit protection on share-code retrieval endpoints

Discovery Timeline

2026-07-20 - CVE-2026-64619 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64619

Vulnerability Analysis

FileCodeBox implements an IPRateLimit mechanism intended to prevent brute-force enumeration of short share codes. The class derives the client IP by reading the X-Real-IP and X-Forwarded-For HTTP headers directly from the request. Neither header is authenticated, and the application does not validate that the socket-level peer belongs to a trusted proxy network.

An attacker who reaches the FileCodeBox instance directly can inject arbitrary values in these headers on each request. The rate limiter treats every unique spoofed IP as a distinct client, so throttling counters never reach their threshold. With throttling neutralized, the attacker can iterate the entire share-code space at network speed. Any matching code returns the associated file to the unauthenticated requester, breaking the confidentiality guarantee of the share-by-code workflow.

Root Cause

The root cause is trust of untrusted input for security decisions. IPRateLimit uses header-derived IP values without checking that request.client.host is within an allow-listed proxy CIDR. The fix introduces trusted-proxy validation using ipaddress.ip_network and a new trustedProxies setting.

Attack Vector

The attack is remote, unauthenticated, and network-based. It requires only HTTP access to the target and does not require user interaction. An attacker sends repeated GET requests to the share retrieval endpoint, mutating X-Forwarded-For on each request while iterating candidate share codes.

python

# Patch: apps/base/dependencies.py — enforce trusted-proxy validation
-from typing import Dict, Union
+from ipaddress import ip_address, ip_network
+from typing import Dict, Iterable, Union
 from datetime import datetime, timedelta
 from fastapi import HTTPException, Request

+from core.settings import settings
+
+
+def _iter_trusted_proxies() -> Iterable[str]:
+    trusted_proxies = getattr(settings, "trustedProxies", [])
+    if isinstance(trusted_proxies, str):
+        trusted_proxies = [item.strip() for item in trusted_proxies.split(",")]
+    return [item for item in trusted_proxies if item]
+
+
+def _is_trusted_proxy(host: str) -> bool:
+    try:
+        remote_addr = ip_address(host)
+    except ValueError:
+        return False
+
+    for proxy in _iter_trusted_proxies():
+        try:
+            if remote_addr in ip_network(proxy, strict=False):
+                return True
+        except ValueError:
+            continue
+    return False

Source: GitHub Commit 1b6d8e7

Detection Methods for CVE-2026-64619

Indicators of Compromise

High volume of requests to share-code retrieval endpoints originating from a single TCP peer but presenting many distinct X-Forwarded-For or X-Real-IP values.
Sequential or randomized share-code parameters iterating across a wide keyspace within short time windows.
HTTP 404 or "code not found" response bursts from FileCodeBox followed by successful 200 responses containing file payloads.

Detection Strategies

Log the TCP source IP separately from header-derived IP values, then alert when a single peer presents more than a small number of unique forwarded IPs per minute.
Deploy Web Application Firewall (WAF) rules that reject requests containing X-Forwarded-For or X-Real-IP when the peer address is outside the documented reverse-proxy range.
Correlate access logs against the FileCodeBox share-code endpoint to identify brute-force enumeration patterns.

Monitoring Recommendations

Enable verbose access logging on the reverse proxy layer, capturing both the true socket peer and the forwarded chain.
Establish a baseline for legitimate share-code retrieval rates and alert on deviations.
Monitor egress volume from the FileCodeBox host for unexpected file transfer spikes indicative of mass extraction.

How to Mitigate CVE-2026-64619

Immediate Actions Required

Upgrade FileCodeBox to version 2.4 or later, which introduces trusted-proxy validation for header-derived client IPs.
Configure the trustedProxies setting to contain only the CIDR ranges of your legitimate reverse proxies.
If direct exposure exists, place FileCodeBox behind a hardened reverse proxy that strips inbound X-Forwarded-For and X-Real-IP headers before forwarding.

Patch Information

The fix is delivered in FileCodeBox Release V2.4 via commit 1b6d8e7. The patch adds _iter_trusted_proxies and _is_trusted_proxy helpers in apps/base/dependencies.py and hardens share-code generation in apps/base/utils.py. Header-supplied IP values are honored only when the TCP peer is within a configured trusted proxy network. Additional context is available in the VulnCheck Advisory and the GitHub Issue Discussion.

Workarounds

Front the application with a reverse proxy such as Nginx or Traefik configured to overwrite forwarded headers with the true client IP.
Apply network-level rate limiting on the reverse proxy or WAF keyed on the true socket peer, independent of application-layer throttling.
Restrict inbound access to FileCodeBox management and retrieval endpoints via IP allow-listing where feasible.

bash

# Nginx: overwrite spoofed headers and enforce true-source rate limiting
limit_req_zone $binary_remote_addr zone=fcb_zone:10m rate=10r/m;

server {
    listen 443 ssl;
    server_name filecodebox.example.com;

    location / {
        limit_req zone=fcb_zone burst=5 nodelay;

        # Strip any client-supplied forwarding headers
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;

        proxy_pass http://127.0.0.1:12345;
    }
}