Race Condition in FileCodeBox File Usage Update Handler

A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.5.0 is able to resolve this issue. The patch is named 8d7d856c62d73badd0797eb4daec8d2ff10a403a. Upgrading the affected component is recommended.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

vastsa FileCodeBox versions up to 2.3 contain a race condition vulnerability in the update_file_usage function within the Pickup Limit Handler component. This CWE-362 flaw allows attackers to manipulate file usage tracking through concurrent requests, potentially bypassing upload limits or quota restrictions. Organizations deploying FileCodeBox for file sharing and management are immediately affected, particularly those relying on the Pickup Limit feature for resource control. With a CVSS score of 7.3 and public exploit code now available, this represents a high-priority remediation target for any instance running vulnerable versions.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to identify the Privilege Escalation attack patterns (TA0004) inherent in this vulnerability. Practitioners using Casky would observe detection findings centered on suspicious concurrent file operation patterns—multiple rapid requests to update_file_usage with identical or sequential file identifiers, timing anomalies in quota enforcement, and exploitation attempts that bypass intended usage limits. The platform's skill set would flag the characteristic fingerprints of race condition exploitation: non-atomic state transitions, inconsistent file usage counters, and requests that succeed outside normal business logic constraints. By mapping these behavioral indicators to MITRE ATT&CK techniques, Casky enables teams to distinguish legitimate file operations from coordinated exploitation attempts targeting the race condition window.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82543.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-82543

Casky has 224 skills that investigate the attack patterns behind CVE-2026-82543. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn