CVE-2026-64836
HighCVSS 8.8Summary
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() function compares realpath() to boolean true, which never succeeds.
Risk Assessment
Authenticated attackers can read, write, or delete files outside the configured document root, potentially leading to data leakage or destruction. Authentication in the application is required.
Recommendation
Update ICEcoder to a version later than 8.1 when available. Until then, restrict the PHP process's filesystem permissions and monitor file operations.
Other vulnerabilities in ICEcoder
See all- CVE-2026-64838High
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations. Authenticated users can relocate files from outside the document root, disclosing file contents and deleting originals.
- CVE-2026-64837High
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php. Authenticated users can inject OS commands through directory names and execute arbitrary commands as the web-server user.
- CVE-2026-63722Critical
ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows an attacker to execute arbitrary OS commands by chaining authentication bypass, CSRF validation bypass, and unsanitized command execution.
- CVE-2022-34026High
ICEcoder v8.1 is vulnerable to a directory traversal attack. This allows an attacker to access files outside the intended directory.
Original NVD description (English source)
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside the configured document root.