Description
ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user.
Published: 2026-08-19
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ICEcoder 8.1 is vulnerable to unauthenticated remote code execution through the terminal-xhr.php endpoint. The flaw combines an authentication bypass (by sending a password parameter), a CSRF validation bypass (using a non‑empty csrf parameter), and unsanitized command execution via PHP's proc_open(). An attacker can craft a single POST request that is executed as the web‑server user, allowing arbitrary OS command execution. This is a high‑severity weakness identified as CWE‑306.

Affected Systems

The vulnerability affects ICEcoder version 8.1. This version is hosted under the ICEcoder product line and is used by developers to edit code in a web interface.

Risk and Exploitability

The CVSS score of 8.7 classifies this flaw as a high‑impact vulnerability. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit the flaw remotely over HTTP, requiring no prior authentication or authorization, making it easily exploitable in a publicly accessible environment.

Generated by OpenCVE AI on August 19, 2026 at 23:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update ICEcoder to the latest released version that contains the patch for this authentication and command execution flaw.
  • Restrict or disable the terminal endpoint (e.g., limit access to trusted IPs or require proper authentication before allowing command execution).
  • Run the web server under a user with minimal privileges and disable or restrict PHP's proc_open() function to prevent arbitrary command execution.

Generated by OpenCVE AI on August 19, 2026 at 23:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Icecoder
Icecoder icecoder
Vendors & Products Icecoder
Icecoder icecoder

Wed, 19 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user.
Title ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Icecoder Icecoder
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-19T19:15:34.562Z

Reserved: 2026-07-17T21:21:58.624Z

Link: CVE-2026-63722

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T20:17:20.380

Modified: 2026-08-19T20:17:20.380

Link: CVE-2026-63722

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T00:00:06Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function