CVE-2025-51661

A path traversal vulnerability exists in FileCodeBox versions v2.2 and earlier when configured to use local filesystem storage. The SystemFileStorage.save_file method in core/storage.py fails to validate user-supplied filenames when constructing the save_path. This allows remote attackers to perf...

CVE-2025-51663

A vulnerability exists in the IPRateLimit implementation of FileCodeBox versions up to 2.2 . Remote attackers can bypass IP-based rate limit protections and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This flaw allows attackers to perform Denial-of-Service (D...

CVE-2025-51662

A stored cross-site scripting (XSS) vulnerability exists in the text sharing feature of FileCodeBox version 2.2 and earlier. The root cause is insufficient input validation , which allows an attacker to inject arbitrary JavaScript code into shared text "codeboxes." When other users access the inf...