The flaw is a race condition in the update_file_usage view of vastsa FileCodeBox’s Pickup Limit Handler accessed via file apps/base/views.py. When an attacker manipulates the input concurrently, the function can process out‑of‑order updates, leading to inconsistent or incorrect file usage bookkeeping. This can be abused to falsify usage statistics, bypass rate limits, or corrupt internal state, which may compromise data integrity or service availability.

The vulnerability exists in vastsa‑maintained FileCodeBox versions up to and including 2.3.0. The fix is available in release 2.5.0 and later. The affected component is the PickUp Limit Handler found within the file apps/base/views.py module. Upgrading to version 2.5.0 removes the race condition.

The CVSS score of 6.9 indicates moderate to high risk. EPSS is not reported, and the vulnerability is not in KEV, but the public exploit is available and can be launched remotely through the update_file_usage endpoint. Attackers could exploit the race condition by sending concurrent requests that cause the server to hold stale data. Given the lack of mitigation in the current code, the risk of exploitation is realistic for actively used systems until patched.